HRDN-7220 conflicts with HRDN-7230 (rkhunter vs as compiler)

[vk6xebec]

Describe the bug
HRDN-7230 checks if there is a malware scanner. One of the scanners suggested by Lynis is RKhunter. HRDN-7220 checks for the presence of a complier.

However, the as (assembly) complier is listed as a required dependency of rkhunter through binutils. Without this program, rkhunter cannot be operated.

Version

• Distribution [e.g. Ubuntu 24.10]
• Lynis version [e.g. 3.1.2]

Expected behavior
Hard one really
Since this is a conflict causing another test to fail, maybe rkhunter not be suggested as a rootkit checker?
or maybe ignore this check?

[teoberi]

Is Rkhunter still significant?

[mboelen]

Not sure why binutils is linked to the rkhunter, as in the past it has no dependencies. Do you know why that is @vk6xebec ?

A few months ago I learned that there is a new maintainer for the project. Otherwise I would have picked it up. So I would say it is still significant, unless there won't be updates within 1 year..

[teoberi]

Without updates for over 6 years, NOW I don't think it's relevant.
It would at least deserve a warning upon detection.
Same with LILO/ELILO here.

[vk6xebec]

@mboelen no am not sure why this would be the case. The tests used to pass till about a year ago. I can't remove binutils without it uninstalling rkhunter and some other programs.

As to if its still relevant, I can't comment as I do not know if technology has changed or so since then - I'll leave it for others to review and comment.

[trelane]

The solution here is removing rkhunter entirely. The project appears to be dead, and recommending it as compliant is a problem if it is unlikely a patch will be issued for vulnerabilities within 30 days. Such a delay violates (at minimum) PCI-DSS.

[teoberi]

I agree with you, in the same situation is Chkrootkit where the last changes have been requested by me in 2023 and since then nothing.