Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm getting a set of warnings via rkhunter that I can't seem to suppress using ALLOWDEVFILE. Here's a piece of what gets flagged:

Checking /dev for suspicious file types         [ Warning ]
Warning: Suspicious file types found in /dev:
/dev/.udev/db/\x2fdevices\x2fvirtual\x2ftty\x2ftty8: ASCII text
/dev/.udev/db/\x2fdevices\x2fvirtual\x2ftty\x2ftty7: ASCII text
/dev/.udev/db/\x2fdevices\x2fvirtual\x2ftty\x2ftty6: ASCII text
/dev/.udev/db/\x2fdevices\x2fvirtual\x2ftty\x2ftty5: ASCII text
/dev/.udev/db/\x2fdevices\x2fvirtual\x2ftty\x2ftty4: ASCII text
/dev/.udev/db/\x2fdevices\x2fvirtual\x2ftty\x2ftty3: ASCII text
/dev/.udev/db/\x2fdevices\x2fvirtual\x2ftty\x2ftty2: ASCII text

I've tried all the following techniques (with and without quotes):

ALLOWDEVFILE = "/dev/.udev/db/\x2fdevices\x2fvirtual\x2ftty\x2ftty8"

ALLOWDEVFILE = "/dev/.udev/db/\\x2fdevices\\x2fvirtual\\x2ftty\\x2ftty8"

Wildcards don't seem to work, either:

ALLOWDEVFILE = "/dev/.udev/db/\x2fdevices\x2fvirtual\*"

There seems to be some issue with the backslashes in the filenames as even normal tab autocomplete of filenames won't work from the command line. Any ideas on how to get rkhunter to stop throwing warnings and constantly emailing me for this set of files?

share|improve this question
What version of rkhunter are you using? Make sure you do not have multiple copies of rkhunter installed. I've seen issues when you install from RPM and source and you end up with different configuration files. Check /usr/local/etc and /etc/ for config files. – jeffatrackaid Jun 25 '14 at 19:15
Nothing in /usr/local/etc. I'm using 1.4.0, which is the most recent package in ubuntu trusty 14.04 right now. It's possible I could find a PPA to grab, but I didn't see anything in 1.4.2 (can't find 1.4.1 release notes) that would solve the issue, either. – AvatarKava Jun 25 '14 at 21:14
Have a look into rkhunter.log, if you find "Info: Using configuration file '/path/to/rkhunter.conf'" to assure that you are editing the active config file. – hellcode Jul 1 '14 at 8:44
Yes, path is correct - the rest of the config parameters work, just not the ignore for these weirdly-escaped filenames. – AvatarKava Jul 2 '14 at 13:08

Ditch the quotes:

ALLOWDEVFILE = /dev/.udev/db/*
share|improve this answer
Same error still occurs - not picking up the files as whitelisted. – AvatarKava May 20 '14 at 19:51

To suppress the rkhunter warning, you can add a whitelist rule to /etc/rkhunter.conf.local:


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.