rkhunter found this...

[Daniel B. Thurman]

Mikkel L. Ellertson wrote:
> Rick Stevens wrote:
>   
>> Do NOT ignore it.  I don't think you quite understand what /dev/null
>> is.  It is supposed to be a device, not a file.  Somehow it got deleted
>> and now whenever a script or something does a redirect of its output to
>> /dev/null, instead of going to a device (and thence into the bit
>> bucket), it creates a file called /dev/null.
>>
>>     
> What the OP found was /dev/nul - one l. I suspect that /dev/null was
> still there.
>
>   
>> To fix it:
>>
>> 1. Do an "ls -Z /dev/null" and make sure there is no _regular_ file,
>> directory, symlink, pipe or anything else called "/dev/null".  Check the
>> first character of the permissions.  If it's anything other than a "c"
>> then delete the file (you may need to do an "rm -rf /dev/null" to kill
>> it).
>>
>> 2. As root, run "MAKEDEV -x null".  That should recreate the device
>> file.
>>
>> 3. Run "ls -Z /dev/null" again and you should see something like:
>>
>> crw-rw-rw-  root root system_u:object_r:null_device_t:s0 /dev/null
>>
>> displayed.  If the first character of the permissions is NOT a "c", it
>> didn't work.
>>
>>     
> If he is running a fairly modern system - one that uses the dev file
> system, and/or runs udev, then udev will re-create it when the
> system reboots. In this case, it /dev/null is really gone, it is
> probably the safest way for hte OP to fix it...
>
> Mikkel
>   
Sigh.  I should have pointed out that my /dev/null is a device (I knew 
that!)and
it is unmolested!

My device /dev/null IS as Mikkel said:
crw-rw-rw-  root root system_u:object_r:null_device_t:s0 /dev/null

Instead, there is a TEXT file created: /dev/nul  (one "l") and rkhunter
reported it's suspicions correctly.

I do NOT have any scripts that I have created (I only have
TWO scripts in my home/bin and I looked with a fine-toothed
comb.  It is not ME that created the /dev/nul (one "l")

Somewhere, the SYSTEM (script or program) is creating it.

The "clue" I left was:
=======[/dev/nul]=========
# more /dev/nul
nsdc: no patch necessary.
^^^^^^^^^^^^^^^^^^^^
========================

For fun,  I looked at: /etc/init.d/nsd and there was code
in two places that had: 2>%1 (a stderr redirect?) and I suspected
it was intended to be: 2>&1?  I was not sure the % was
something I have seen before - this does not exists in the
entire /etc/init.d directory except for nsd!  Bug????

Thanks!
Dan