where is rkhunter cron controlled?

eLIANT

Active Member
Aug 14, 2006
30
3
158
Many questions about rkhunter here and in other threads, but none answer this basic question... Where is the rkhunter cron information? More specifically, /etc/cron.d holds several files that control various cron jobs using strings like this:
4 0 * * * root /usr/bin/yum -y -R 10 -d 0 -e 0 update yum
46 6 * * 6 root /usr/bin/yum -y -R 120 -d 0 -e 0 update
My question is: Where is this same information for the rkhunter cron job?
 
Last edited by a moderator:

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
11,793
1,878
363
cPanel Access Level
Root Administrator
Hey there! rkhunter isn't something that ships with cPanel, so I'm not sure I'll have this answer. By default, the tool just gets installed from source and there is no automation or cron as part of the configuration that I'm aware of.

I'd also caution against using that tool, as the last stable release is from 20 February 2018, so I doubt it would be useful.
 

eLIANT

Active Member
Aug 14, 2006
30
3
158
I'd be happy to disable it. But to do that I still need an answer to my original post.
 

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
11,793
1,878
363
cPanel Access Level
Root Administrator
I'm not sure there's going to be a good answer for you, since that software is manually configured outside of cPanel tools. I would normally expect to find something in /etc/cron.d, but it's also possible this could be in root's crontab, which you can check with "crontab -e" from the command line.
 

ejsolutions

Well-Known Member
Jan 6, 2013
77
32
68
cPanel Access Level
Root Administrator
Depending on how you installed it..
/etc/cron.daily/rkhunter.sh
 
Last edited:

eLIANT

Active Member
Aug 14, 2006
30
3
158
CRONTAB -E:
23 15 * * * /usr/local/cpanel/scripts/exim_tidydb > /dev/null 2>&1
48 14 * * * /usr/local/cpanel/scripts/optimize_eximstats > /dev/null 2>&1
#5,35 * * * * /usr/local/bandmin/bandmin
#27 0 * * * /usr/local/bandmin/ipaddrmap
#3 21 * * 1 (/usr/local/cpanel/scripts/fix-cpanel-perl; /usr/local/cpanel/script/upcp --cron > /dev/null)
3 21 * * * (/usr/local/cpanel/scripts/fix-cpanel-perl; /etc/upcp_control)
27 * * * * /usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check
6 */4 * * * /usr/bin/test -x /usr/local/cpanel/scripts/update_mailman_cache && /usr/local/cpanel/scripts/update_mailman_cache
38 */4 * * * /usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache
22 */2 * * * /usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1
32 */2 * * * /usr/local/cpanel/bin/dbindex >/dev/null 2>&1
8 */6 * * * /usr/local/cpanel/scripts/autorepair recoverymgmt >/dev/null 2>&1
*/5 * * * * /usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1
43 0 * * * /usr/local/cpanel/whostmgr/docroot/cgi/cpaddons_report.pl --notify
8,23,38,53 * * * * /usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1
0 2 * * * /usr/local/cpanel/bin/backup
5,20,35,50 * * * * /usr/local/cpanel/scripts/eximstats_spam_check 2>&1
0 */2 * * * /usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1

and /etc/cron.d contains these filles:
0hourly
cpanel-analytics
cpanel_autossl
imunify-antivirus
imunify-notifier
imunify_scan_schedule
kcare-cron
kcare-cron.rpmnew
libcare-cron
mailman
raid-check
run_arping_cron
softaculous
softaculous2
sys-snap
sysstat
wordpress_update_local
wp-toolkit-update
yum

Nothing about rkhunter.
/etc/cron.daily has file "rkhuinter" but it is the actual script, not the cron configuration line.

Other suggestions?
 
  • Like
Reactions: cPRex

ejsolutions

Well-Known Member
Jan 6, 2013
77
32
68
cPanel Access Level
Root Administrator
Nothing about rkhunter.
/etc/cron.daily has file "rkhuinter" but it is the actual script, not the cron configuration line.
You're not fully understanding how crontabs work. That IS the file that runs khunter on a daily basis.
mv /etc/cron.daily/rkhunter.sh /root/rkhunter.disabled
 
  • Like
Reactions: cPRex

eLIANT

Active Member
Aug 14, 2006
30
3
158
Thanks for that information.
So, just by existing in the cron.daily folder this rkhunter script runs? What kicks it off? Because it runs every 20 hours.
 

ejsolutions

Well-Known Member
Jan 6, 2013
77
32
68
cPanel Access Level
Root Administrator