Tell rkhunter to ignore
/etc/passwd by inserting
EXISTWHITELIST="/etc/passwd" in your rkhunter configuration file. If you prefer not to make this change to your configuration file, make sure you run
rkhunter --propupd with the same
PATH as given in
/etc/crontab. A command like
env -i PATH=/etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin rkhunter --propupd
should suffice. Thanks to Mr. Torfinn Ingolfsen for his effort to track down this problem.