Add patch to find systemd-journald config and avoid warning. Fixes rhbz#2361203

Add patch to fix false positive on Li0n from bin/sbin merge. Fixes rhbz#2382304

rkhunter-1.4.6-Li0n-fix.patch

@@ -0,0 +1,13 @@
+diff --color -Nur rkhunter-1.4.6/files/rkhunter rkhunter-1.4.6-build/rkhunter-1.4.6/files/rkhunter
+--- rkhunter-1.4.6/files/rkhunter	2026-01-03 10:15:00.159046977 -0800
++++ rkhunter-1.4.6/files/rkhunter	2026-01-03 10:22:54.440297219 -0800
+@@ -8680,8 +8680,7 @@
+ 
+ 
+ 	# Lion Worm
+-	LION_FILES="/bin/in.telnetd
+-		    /bin/mjy
++	LION_FILES="/bin/mjy
+ 		    /usr/man/man1/man1/lib/.lib/mjy
+ 		    /usr/man/man1/man1/lib/.lib/in.telnetd
+ 		    /usr/man/man1/man1/lib/.lib/.x

rkhunter-1.4.6-fedoraconfig.patch

@@ -1,12 +1,6 @@
-diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.conf
+diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.conf
 --- rkhunter-1.4.6.orig/files/rkhunter.conf	2018-02-19 15:49:06.000000000 -0800
-+++ rkhunter-1.4.6/files/rkhunter.conf	2020-05-16 14:20:16.767707769 -0700
-@@ -1,4 +1,4 @@
--#
-+##
- # This is the main configuration file for Rootkit Hunter.
- #
- # You can modify this file directly, or you can create a local configuration
++++ rkhunter-1.4.6/files/rkhunter.conf	2022-06-11 09:58:09.740944517 -0700
 @@ -158,6 +158,7 @@
  # default directory beneath the installation directory.
  #
@@ -82,7 +76,7 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.
  
  #
  # It is possible that a file, which is part of a package, may have been
-@@ -558,6 +566,14 @@
+@@ -558,6 +566,17 @@
  # The default value is the null string.
  #
  #EXISTWHITELIST=""
@@ -91,13 +85,16 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.
 +EXISTWHITELIST=/var/log/pki-ca/system
 +# FreeIPA Certificate Authority
 +EXISTWHITELIST=/var/log/pki/pki-tomcat/ca/system
++# FreeIPA with KRA (Password Vault)
++EXISTWHITELIST=/var/log/pki/pki-tomcat/kra/system
++RTKT_FILE_WHITELIST=/var/log/pki/pki-tomcat/kra/system
 +# Some non default installed files we check
 +EXISTWHITELIST=/usr/bin/GET
 +EXISTWHITELIST=/usr/bin/whatis
  
  #
  # Whitelist various attributes of the specified file. The attributes are those
-@@ -588,6 +604,12 @@
+@@ -588,6 +607,10 @@
  # The default value is the null string.
  #
  #SCRIPTWHITELIST=/usr/bin/groups
@@ -105,12 +102,10 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.
 +SCRIPTWHITELIST=/usr/bin/ldd
 +SCRIPTWHITELIST=/usr/bin/groups
 +SCRIPTWHITELIST=/usr/bin/GET
-+SCRIPTWHITELIST=/sbin/ifup
-+SCRIPTWHITELIST=/sbin/ifdown
  
  #
  # Allow the specified file to have the immutable attribute set.
-@@ -630,6 +652,19 @@
+@@ -630,6 +653,19 @@
  #ALLOWHIDDENDIR=/dev/.udev
  #ALLOWHIDDENDIR=/dev/.udevdb
  #ALLOWHIDDENDIR=/dev/.mdadm
@@ -130,12 +125,10 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.
  
  #
  # Allow the specified hidden file to be whitelisted.
-@@ -644,7 +679,33 @@
- #ALLOWHIDDENFILE=/usr/lib/.libfipscheck.so.1.1.0.hmac
+@@ -645,6 +681,36 @@
  #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac
  #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac
--#ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
-+ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
+ #ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
 +ALLOWHIDDENFILE="/usr/share/man/man1/..1.gz"
 +ALLOWHIDDENFILE=/lib*/.libcrypto.so.*.hmac
 +ALLOWHIDDENFILE=/lib*/.libssl.so.*.hmac
@@ -162,24 +155,17 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.
 +ALLOWHIDDENFILE=/etc/.bzrignore
 +# systemd
 +ALLOWHIDDENFILE=/etc/.updated
++# containers-common
++ALLOWHIDDENFILE=/usr/share/man/man5/.containerignore.5.gz
++# containers-common (older versions)
++ALLOWHIDDENFILE=/usr/share/man/man5/.dockerignore.5.gz
  
  #
  # Allow the specified process to use deleted files. The process name may be
-@@ -714,6 +775,35 @@
+@@ -714,6 +780,37 @@
  #
  #ALLOWDEVFILE=/dev/shm/pulse-shm-*
  #ALLOWDEVFILE=/dev/shm/sem.ADBE_*
-+# Allow PCS/Pacemaker/Corosync
-+ALLOWDEVFILE=/dev/shm/qb-attrd-*
-+ALLOWDEVFILE=/dev/shm/qb-cfg-*
-+ALLOWDEVFILE=/dev/shm/qb-cib_rw-*
-+ALLOWDEVFILE=/dev/shm/qb-cib_shm-*
-+ALLOWDEVFILE=/dev/shm/qb-corosync-*
-+ALLOWDEVFILE=/dev/shm/qb-cpg-*
-+ALLOWDEVFILE=/dev/shm/qb-lrmd-*
-+ALLOWDEVFILE=/dev/shm/qb-pengine-*
-+ALLOWDEVFILE=/dev/shm/qb-quorum-*
-+ALLOWDEVFILE=/dev/shm/qb-stonith-*
 +ALLOWDEVFILE=/dev/shm/pulse-shm-*
 +ALLOWDEVFILE=/dev/md/md-device-map
 +# tomboy creates this one
@@ -196,12 +182,25 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.
 +ALLOWDEVFILE=/dev/shm/squid-cf*
 +# squid ssl cache
 +ALLOWDEVFILE=/dev/shm/squid-ssl_session_cache.shm
++# allow lldpad state file
++ALLOWDEVFILE=/dev/shm/lldpad.state
++# Allow PCS/Pacemaker/Corosync
++ALLOWDEVFILE=/dev/shm/qb-attrd-*
++ALLOWDEVFILE=/dev/shm/qb-cfg-*
++ALLOWDEVFILE=/dev/shm/qb-cib_rw-*
++ALLOWDEVFILE=/dev/shm/qb-cib_shm-*
++ALLOWDEVFILE=/dev/shm/qb-corosync-*
++ALLOWDEVFILE=/dev/shm/qb-cpg-*
++ALLOWDEVFILE=/dev/shm/qb-lrmd-*
++ALLOWDEVFILE=/dev/shm/qb-pengine-*
++ALLOWDEVFILE=/dev/shm/qb-quorum-*
++ALLOWDEVFILE=/dev/shm/qb-stonith-*
 +# Allow podman
 +ALLOWDEVFILE=/dev/shm/libpod*lock*
  
  #
  # Allow the specified process pathnames to use shared memory segments.
-@@ -1090,6 +1180,14 @@
+@@ -1090,6 +1187,11 @@
  #
  #RTKT_DIR_WHITELIST=""
  #RTKT_FILE_WHITELIST=""
@@ -210,13 +209,10 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.
 +RTKT_FILE_WHITELIST=/var/log/pki-ca/system
 +# FreeIPA Certificate Authority
 +RTKT_FILE_WHITELIST=/var/log/pki/pki-tomcat/ca/system
-+# FreeIPA with KRA (Password Vault)
-+EXISTWHITELIST=/var/log/pki/pki-tomcat/kra/system
-+RTKT_FILE_WHITELIST=/var/log/pki/pki-tomcat/kra/system
  
  #
  # The following option can be used to whitelist shared library files that would
-@@ -1329,3 +1427,5 @@
+@@ -1329,3 +1431,5 @@
  # The default value is '0'.
  #
  #GLOBSTAR=0

rkhunter-1.4.6-grep-fix.patch

@@ -0,0 +1,21 @@
+diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunter
+--- rkhunter-1.4.6.orig/files/rkhunter	2025-05-04 10:41:26.009520652 -0700
++++ rkhunter-1.4.6/files/rkhunter	2025-05-04 10:37:49.439199695 -0700
+@@ -6691,7 +6691,7 @@
+ 					#
+ 
+ 					if [ $ERRCODE -eq 1 -a $BINISLINK -eq 1 ]; then
+-						if [ -n "`echo \"$FNAME\" | grep '^\/usr\/'`" ]; then
++						if [ -n "`echo \"$FNAME\" | grep '^/usr/'`" ]; then
+ 							RKHTMPVAR3=`echo "$FNAMEGREP" | sed -e 's:^/usr::'`
+ 						else
+ 							RKHTMPVAR3="/usr${FNAMEGREP}"
+@@ -11005,7 +11005,7 @@
+ 						#
+ 
+ 						if [ $ERRCODE -eq 1 -a $BINISLINK -eq 1 ]; then
+-							if [ -n "`echo \"${FNAME}\" | grep '^\/usr\/'`" ]; then
++							if [ -n "`echo \"${FNAME}\" | grep '^/usr/'`" ]; then
+ 								RKHTMPVAR3=`echo "${FNAMEGREP}" | sed -e 's:^/usr::'`
+ 							else
+ 								RKHTMPVAR3="/usr${FNAMEGREP}"

rkhunter-1.4.6-grep.patch

@@ -0,0 +1,35 @@
+diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunter
+--- rkhunter-1.4.6.orig/files/rkhunter	2023-04-29 09:32:39.288709203 -0700
++++ rkhunter-1.4.6/files/rkhunter	2023-04-29 10:00:29.396271053 -0700
+@@ -70,7 +70,7 @@
+ # we exec to log everything to the debug file.
+ #
+ 
+-if [ -n "`echo \"$*\" | grep '\-\-debug'`" ]; then
++if [ -n "`echo \"$*\" | grep '\--debug'`" ]; then
+ 	RKHDEBUGFILE=""
+ 	RKHDEBUGBASE="/tmp/rkhunter-debug"
+ 
+@@ -181,9 +181,11 @@
+ # used. If it is, then some typical grep tests will fail.
+ #
+ 
+-if [ "`echo \"rkh-grep-test\" | grep '^\+'`" = "rkh-grep-test" ]; then
++# fedora always uses POSIX grep and set an alias here for depreciated egrep too
++#if [ "`echo \"rkh-grep-test\" | grep '^\+'`" = "rkh-grep-test" ]; then
+ 	alias grep='grep -E'
+-fi
++	alias egrep='grep -E'
++#fi
+ 
+ 
+ #
+@@ -9585,7 +9587,7 @@
+ 		    rpc.nfsd:tcp.log:Sniffer installed
+ 		    sshd:/dev/ptyxx:OpenBSD Rootkit
+ 		    sshd:/.config:SHV4 Rootkit
+-		    sshd:+\\$.*\\$\!.*\!\!\\$:Backdoored SSH daemon installed
++		    sshd:+\\$.*\\$!.*!!\\$:Backdoored SSH daemon installed
+ 		    sshd:backdoor.h:Trojaned SSH daemon
+ 		    sshd:backdoor_active:Trojaned SSH daemon
+ 		    sshd:magic_pass_active:Trojaned SSH daemon

rkhunter-1.4.6-journald-config.patch

@@ -0,0 +1,12 @@
+diff --color -Nur rkhunter-1.4.6/files/rkhunter rkhunter-1.4.6-build/rkhunter-1.4.6/files/rkhunter
+--- rkhunter-1.4.6/files/rkhunter	2026-01-03 10:15:00.159046977 -0800
++++ rkhunter-1.4.6/files/rkhunter	2026-01-03 10:18:12.190029798 -0800
+@@ -17615,7 +17615,7 @@
+ 		#
+ 
+ 		if [ -z "${SYSLOG_CONFIG_FILE}" ]; then
+-			SYSLOG_CONFIG_FILE="/etc/syslog.conf /etc/rsyslog.conf /etc/syslog-ng/syslog-ng.conf /etc/systemd/journald.conf /etc/systemd/systemd-journald.conf"
++			SYSLOG_CONFIG_FILE="/etc/syslog.conf /etc/rsyslog.conf /etc/syslog-ng/syslog-ng.conf /etc/systemd/journald.conf /etc/systemd/systemd-journald.conf /usr/lib/systemd/journald.conf"
+ 		fi
+ 
+ 		if [ "${SYSLOG_CONFIG_FILE}" = "NONE" ]; then

rkhunter-1.4.6-ssh.d.patch

@@ -0,0 +1,43 @@
+diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunter
+--- rkhunter-1.4.6.orig/files/rkhunter	2021-02-07 13:58:43.355270731 -0800
++++ rkhunter-1.4.6/files/rkhunter	2021-02-07 14:02:41.551554134 -0800
+@@ -17379,6 +17379,12 @@
+ 			fi
+ 		done
+ 
++			if [ -d "${SSH_CONFIG_FILE}.d" ];then
++				SSH_CONFIG_FILE="${SSH_CONFIG_FILE} ${SSH_CONFIG_FILE}.d/*"
++			else
++				:
++			fi
++
+ 		if [ -n "${SSH_CONFIG_FILE}" ]; then
+ 			display --to SCREEN+LOG --type PLAIN --result FOUND --color GREEN --log-indent 2 --screen-indent 4 SYSTEM_CONFIGS_FILE_SSH
+ 
+@@ -17396,7 +17402,7 @@
+ 			# First we check for allowed root access.
+ 			#
+ 
+-			RKHTMPVAR=`grep -i '^[ 	]*PermitRootLogin[ 	=]' "${SSH_CONFIG_FILE}" 2>/dev/null | tail ${TAIL_OPT}1`
++			RKHTMPVAR=`grep -ih '^[         ]*PermitRootLogin[      =]' ${SSH_CONFIG_FILE} 2>/dev/null | tail ${TAIL_OPT}1`
+ 
+ 			if [ -n "${RKHTMPVAR}" ]; then
+ 				#
+@@ -17427,7 +17433,7 @@
+ 			# Next we check to see if protocol version 1 is allowed.
+ 			#
+ 
+-			RKHTMPVAR=`grep -i '^[ 	]*Protocol[ 	=]' "${SSH_CONFIG_FILE}" 2>/dev/null | tail ${TAIL_OPT}1`
++			RKHTMPVAR=`grep -i '^[ 	]*Protocol[ 	=]' ${SSH_CONFIG_FILE} 2>/dev/null | tail ${TAIL_OPT}1`
+ 
+ 			if [ -n "${RKHTMPVAR}" ]; then
+ 				#
+@@ -17467,7 +17473,7 @@
+ 			# First check for the Ebury backdoor.
+ 			#
+ 
+-			RKHTMPVAR=`grep -i '^[ 	]*AuthorizedKeysFile[ 	=]' "${SSH_CONFIG_FILE}" 2>/dev/null | tail ${TAIL_OPT}1`
++			RKHTMPVAR=`grep -i '^[ 	]*AuthorizedKeysFile[ 	=]' ${SSH_CONFIG_FILE} 2>/dev/null | tail ${TAIL_OPT}1`
+ 
+ 			if [ -n "${RKHTMPVAR}" ]; then
+ 				RKHTMPVAR2=`echo ${RKHTMPVAR} | sed -e 's/^[^ 	=]*[ 	]*=*[ 	]*\([^ 	#]*\).*$/\1/'`

rkhunter.spec

@@ -3,23 +3,34 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        3%{?dist}
+Release:        31%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
-Group:          Applications/System
-License:        GPLv2+
+# Automatically converted from old format: GPLv2+ - review is highly recommended.
+License:        GPL-2.0-or-later
 URL:            http://rkhunter.sourceforge.net/
 Source0:        http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.tar.gz
 Source2:        01-rkhunter
 Source3:        rkhunter.sysconfig
-Patch0:         rkhunter-1.4.6-epel7.patch
+Patch0:         rkhunter-1.4.6-fedoraconfig.patch
+# libkeyutils is an actual legit library now, so this old check is a false positive.
 Patch1:         rkhunter-1.4.6-drop-libkeyutils-check.patch
+# have ssh checks use the sshd.d directoy config files too.
+Patch2:         rkhunter-1.4.6-ssh.d.patch
+# Fix grep/egrep changes in f38+
+Patch3:         rkhunter-1.4.6-grep.patch
+# Fix grep warning about escaping / in f42+
+Patch4:         rkhunter-1.4.6-grep-fix.patch
+# Fix systemd-journald config path
+Patch5:         rkhunter-1.4.6-journald-config.patch
+# Fix false positive Li0n detection due to bin/sbin merge
+Patch6:         rkhunter-1.4.6-Li0n-fix.patch
 BuildArch:      noarch
-BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
+BuildRequires:      perl-generators
 
 Requires:       coreutils, binutils, kmod, findutils, grep
 Requires:       e2fsprogs, procps, lsof, iproute, wget
-Requires:       perl, perl(strict), perl(IO::Socket), mailx, logrotate
+Requires:       perl-interpreter, perl(strict), perl(IO::Socket), s-nail, logrotate
 Requires:       crontabs
 
 %description
@@ -76,11 +87,7 @@ EOF
 %{__install} -m640 -p files/%{name}.conf        ${RPM_BUILD_ROOT}%{_sysconfdir}/
 %{__install} -m640 -p %{SOURCE3}                ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/%{name}
 
-%clean
-%{__rm} -rf $RPM_BUILD_ROOT
-
 %files
-%defattr(-,root,root,-)
 %doc %{_pkgdocdir}/*
 %{_bindir}/%{name}
 %dir %{_datadir}/%{name}
@@ -88,9 +95,10 @@ EOF
 %{_sysconfdir}/cron.daily/%{name}
 %config(noreplace) %{_sysconfdir}/logrotate.d/%{name}
 %dir %{_var}/lib/%{name}
-%{_var}/lib/%{name}/db
+%dir %{_var}/lib/%{name}/db
 %ghost %{_var}/lib/%{name}/db/mirrors.dat
 %ghost %{_var}/lib/%{name}/db/programs_bad.dat
+%ghost %{_var}/lib/%{name}/db/backdoorports.dat
 %{_var}/lib/%{name}/db/i18n
 %dir %{_var}/log/%{name}
 %config(noreplace) %{_sysconfdir}/%{name}.conf
@@ -99,37 +107,148 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
-* Tue May 04 2021 Kevin Fenzi <kevin@scrye.com> - 1.4.6-3
-- Add patch to fix false positive for libkeyutils
+* Sat Jan 03 2026 Kevin Fenzi <kevin@scrye.com> - 1.4.6-31
+- Add patch to find systemd-journald config and avoid warning. Fixes rhbz#2361203
+- Add patch to fix false positive on Li0n from bin/sbin merge. Fixes rhbz#2382304
 
-* Sat May 16 2020 Kevin Fenzi <kevin@scrye.com> - 1.4.6-2
+* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-30
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Sun May 04 2025 Kevin Fenzi <kevin@scrye.com> - 1.4.6-29
+- Add fix for additional case of grep warnings with cron.
+
+* Sat Apr 19 2025 Kevin Fenzi <kevin@scrye.com> - 1.4.6-28
+- Add a fix to grep warning about escaping /s. Fixes rhbz#2360502
+
+* Sat Jan 18 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-27
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Fri Jul 26 2024 Miroslav Suchý <msuchy@redhat.com> - 1.4.6-26
+- convert license to SPDX
+
+* Fri Jul 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-25
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Fri Jan 26 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-24
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Mon Jan 22 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-23
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Fri Jul 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-22
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Sat Apr 29 2023 Kevin Fenzi <kevin@scrye.com> - 1.4.6-21
+- More complete fix for egrep changes.
+
+* Mon Apr 10 2023 Kevin Fenzi <kevin@scrye.com> - 1.4.6-20
+- Patch grep/egrep changes to avoid warnings in F38+
+
+* Fri Jan 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-19
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-18
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Sun Jun 19 2022 Kevin Fenzi <kevin@scrye.com> - 1.4.6-17
+- Switch to using s-nail instead of mailx.
+
+* Sat Jun 11 2022 Kevin Fenzi <kevin@scrye.com> - 1.4.6-16
+- Whitelist .dockerignore man page ( rhbz#2050551 )
+
+* Fri Jan 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-15
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Sat Nov 06 2021 Kevin Fenzi <kevin@scrye.com> - 1.4.6-14
+- Add exclude for containers-common man page ( rhbz#2020015 )
+
+* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-13
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Sun Feb 07 2021 Kevin Fenzi <kevin@scrye.com> - 1.4.6-12
+- Fix bug around ssh protocol detection ( rhbz#1597635 )
+
+* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-11
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Sat Jan 16 2021 Kevin Fenzi <kevin@scrye.com> - 1.4.6-10
+- Drop check on libkeyutils, it's a legit library now. Fixes rhbz#1914662
+- Look for and use the ssh.d config snippet direction. Thanks John Dodson for patch. Fixes rhbz#1851620
+
+* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-9
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Sat May 16 2020 Kevin Fenzi <kevin@scrye.com> - 1.4.6-8
 - Add allow for podman's /dev/shm files (fixes bug #1828698 )
 
+* Thu Jan 30 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Sun Oct 06 2019 Kevin Fenzi <kevin@scrye.com> - 1.4.6-6
+- Adjust config for PermitRootLogin change in f31+. Fixes bug #1756593
+
+* Fri Jul 26 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Sun Apr 14 2019 Kevin Fenzi <kevin@scrye.com> - 1.4.6-4
+- Drop ifup/ifdown since network-scripts is now deprecated. Fixes bug #1698920
+
+* Sat Feb 02 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
 * Sun Feb 25 2018 Kevin Fenzi <kevin@scrye.com> - 1.4.6-1
-- Upgrade to 1.4.6. Fixes bug #1524456
+- Update to 1.4.6. Fixes bug #1547315
 - Allow KRA vault log files. Fixes bug #1541472
 - ipc_shared_mem warning fixed upstream. Fixes bug #1524456
 
-* Sat Aug 12 2017 Kevin Fenzi <kevin@scrye.com> - 1.4.4-3
+* Fri Feb 09 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 1.4.4-6
+- Escape macros in %%changelog
+
+* Mon Nov 27 2017 Kevin Fenzi <kevin@scrye.com> - 1.4.4-5
+- Add fix for new rpm queryformat and ARCH. Fixes bug #1517387
+
+* Sat Aug 12 2017 Kevin Fenzi <kevin@scrye.com> - 1.4.4-4
 - Disable ipc_shared_mem test for now due to false positives. Bug #1472299
 
-* Mon Jul 03 2017 Kevin Fenzi <kevin@scrye.com> - 1.4.4-2
-- Correct some rebasing errors on config.
+* Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.4-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
 
-* Fri Jun 30 2017 Kevin Fenzi <kevin@scrye.com> - 1.4.4-1
+* Thu Jul 13 2017 Petr Pisar <ppisar@redhat.com> - 1.4.4-2
+- perl dependency renamed to perl-interpreter
+  <https://fedoraproject.org/wiki/Changes/perl_Package_to_Install_Core_Modules>
+
+* Thu Jun 29 2017 Kevin Fenzi <kevin@scrye.com> - 1.4.4-1
 - Update to 1.4.4. Fixes bug #1466318
 - Fix for logger and spaces. Fixes bug #1284403
 
-* Wed Jan 25 2017 Mukundan Ragavan <nonamedotc@fedoraproject.org> - 1.4.2-8
+* Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.2-13
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
+
+* Wed Jan 25 2017 Mukundan Ragavan <nonamedotc@fedoraproject.org> - 1.4.2-12
 - Add /dev/shm/qb* files to whitelist. Fixes bug #1403602
 - Add /dev/shm/squid-ssl_session_cache.shm to whitelist. Fixes bug #1411130
 
-* Tue Jan 05 2016 Mukundan Ragavan <nonamedotc@fedoraproject.org> - 1.4.2-7
-- Fix ssh config value in patch
+* Wed Apr 20 2016 Kevin Fenzi <kevin@scrye.com> - 1.4.2-11
+- Add /dev/shm/lldpad files to whitelist. Fixes bug #1293059
 
-* Thu Dec 31 2015 Mukundan Ragavan <nonamedotc@gmail.com> - 1.4.2-6
-- Allow /etc/.updated on EL7
-- Fixes bug#1291629
+* Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.2-10
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
+
+* Sun Dec 06 2015 Kevin Fenzi <kevin@scrye.com> - 1.4.2-9
+- Add /dev/shm/squid files to whitelist. Fixes bug #1279632
+
+* Tue Oct 13 2015 Mukundan Ragavan <nonamedotc@fedoraproject.org> - 1.4.2-8
+- Change config patch to account for change in default SSH config
+
+* Thu Jun 18 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.2-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
+
+* Sat Dec 20 2014 Kevin Fenzi <kevin@scrye.com> 1.4.2-6
+- Add /etc/.updated systemd file to whitelist. Fixes bug #1173481
+- Add patch to fix grep -a issue with too many arguments output. 
 
 * Mon Oct 27 2014 Kevin Fenzi <kevin@scrye.com> 1.4.2-5
 - Set /var/lib/rkhunter to be mode 700. fixes bug #1154428
@@ -195,7 +314,7 @@ EOF
 - Add /usr/share/man/man5/.k5identity.5.gz to whitelisted hidden files. 
 
 * Wed Oct 12 2011 Jim Pirzyk <jim+rpm@pirzyk.org> - 1.3.8-10
-- Update %files section so that some .dat files are marked %ghost
+- Update %%files section so that some .dat files are marked %%ghost
 
 * Fri Aug 05 2011 Kevin Fenzi <kevin@scrye.com> - 1.3.8-9
 - Add patch to fix ALLOWPROCDELFILE config option. fixes bug #727524