I noticed that on my two servers, the rkhunter update wasn't completing correctly. The problem stems from the redirection that sourceforge.net performs from http to https. Here's how I solved it in case anyone else encounters the same problem. Download the mirrors.dat file: https://rkhunter.sourceforge.net/1.4/mirrors.dat Replace the entire contents of the server's /var/lib/rkhunter/db/mirrors.dat file with the downloaded file. It would look like this: Code: nano /var/lib/rkhunter/db/mirrors.dat Version: 2021020602 mirror=http://rkhunter.sourceforge.net remote=http://rkhunter.sourceforge.net Edit the rkhunter.conf file. Locate the following variables and reassign their values. Code: nano /etc/rkhunter.conf UPDATE_MIRRORS=0 MIRRORS_MODE=2 WEB_CMD=curl -L That's it, you can now update rkhunter from the console # sudo rkhunter --versioncheck # sudo rkhunter --update # sudo rkhunter --propupd # sudo rkhunter --check
