saving uncommitted changes in /etc prior to apt run

crontab

@@ -13,7 +13,7 @@ PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
 44 2 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
 53 3 3 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
 #
-10 3 * * * root /usr/local/bin/rkhunter --cronjob 
+10 3 * * * root /usr/bin/rkhunter --cronjob --update --quiet
 
 #0 5 * * * root /bin/systemctl restart nginx
 

motd

@@ -1,7 +0,0 @@
-
-The programs included with the Debian GNU/Linux system are free software;
-the exact distribution terms for each program are described in the
-individual files in /usr/share/doc/*/copyright.
-
-Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
-permitted by applicable law.

rkhunter.conf

@@ -141,7 +141,7 @@ MAIL-ON-WARNING=admin@solusar.de
 # The default is to use the 'mail' command, with a subject line
 # of '[rkhunter] Warnings found for ${HOST_NAME}'.
 #
-#MAIL_CMD=mail -s "[rkhunter] Warnings found for ${HOST_NAME}"
+MAIL_CMD=mail -s "[rkhunter] Warnings found for ${HOST_NAME}"
 
 #
 # This option specifies the directory to use for temporary files.
@@ -218,7 +218,7 @@ SCRIPTDIR=/usr/share/rkhunter/scripts
 # The default value is the null string, indicating that all the language files
 # will be updated.
 #
-UPDATE_LANG="en"
+UPDATE_LANG="en de"
 
 #
 # This option specifies the log file pathname. The file will be created if it
@@ -586,6 +586,8 @@ PKGMGR=DPKG
 #
 SCRIPTWHITELIST=/bin/egrep
 SCRIPTWHITELIST=/bin/fgrep
+SCRIPTWHITELIST=/usr/bin/egrep
+SCRIPTWHITELIST=/usr/bin/fgrep
 SCRIPTWHITELIST=/bin/which
 SCRIPTWHITELIST=/usr/bin/ldd
 #SCRIPTWHITELIST=/usr/bin/lwp-request
@@ -619,7 +621,7 @@ SCRIPTWHITELIST=/usr/sbin/adduser
 # The default value is the null string.
 #
 #ALLOWHIDDENDIR=/etc/.java
-#ALLOWHIDDENDIR=/etc/.git
+ALLOWHIDDENDIR=/etc/.git
 #ALLOWHIDDENDIR=/dev/.lxc
 
 #
@@ -638,9 +640,8 @@ SCRIPTWHITELIST=/usr/sbin/adduser
 #ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
 #ALLOWHIDDENFILE=/usr/share/man/man5/.k5login.5.gz
 #ALLOWHIDDENFILE=/usr/share/man/man5/.k5identity.5.gz
-#ALLOWHIDDENFILE=/etc/.gitignore
+ALLOWHIDDENFILE=/etc/.gitignore
-#ALLOWHIDDENFILE=/etc/.bzrignore
+ALLOWHIDDENFILE=/etc/.etckeeper
-#ALLOWHIDDENFILE=/etc/.etckeeper
 
 #
 # Allow the specified process to use deleted files. The process name may be
@@ -659,6 +660,10 @@ SCRIPTWHITELIST=/usr/sbin/adduser
 #ALLOWPROCDELFILE=/usr/sbin/mysqld:/tmp/ib*
 #ALLOWPROCDELFILE=/usr/lib/iceweasel/iceweasel
 #ALLOWPROCDELFILE=/usr/bin/file-roller
+ALLOWPROCDELFILE=/usr/sbin/dovecot:/run/dovecot/login-master-*
+ALLOWPROCDELFILE=/usr/sbin/mariadbd:/tmp/*
+ALLOWPROCDELFILE=/usr/sbin/php-fpm8.0:/tmp/.ZendSem.*
+ALLOWPROCDELFILE=/usr/lib/dovecot/imap-login:/run/dovecot/login-master-*
 
 #
 # Allow the specified process to listen on any network interface.
@@ -705,6 +710,8 @@ SCRIPTWHITELIST=/usr/sbin/adduser
 #
 #ALLOWDEVFILE=/dev/shm/pulse-shm-*
 #ALLOWDEVFILE=/dev/shm/sem.ADBE_*
+ALLOWDEVFILE=/dev/shm/rhm.*
+
 
 #
 # This option is used to indicate if the Phalanx2 test is to perform a basic
@@ -1107,7 +1114,7 @@ SCRIPTWHITELIST=/usr/sbin/adduser
 #
 # This option has no default value.
 #
-WEB_CMD="curl"
+WEB_CMD=""
 
 #
 # Set the following option to '1' if locking is to be used when rkhunter runs.
@@ -1202,7 +1209,7 @@ WEB_CMD="curl"
 #
 # The default value is '0'.
 #
-DISABLE_UNHIDE=1
+#DISABLE_UNHIDE=1
 
 INSTALLDIR=/usr