improve rkhunter to include changed users/groups