chkrootkit.org FAQ item number 7[/url]"]7. I'm running PortSentry/klaxon. What's wrong with the bindshell test?
If you're running PortSentry/klaxon or another program that binds itself to unused ports probably chkrootkit will give you a false positive on the bindshell test (ports 114/tcp, 465/tcp, 511/tcp, 1008/tcp, 1524/tcp, 1999/tcp, 3879/tcp, 4369/tcp, 5665/tcp, 10008/tcp, 12321/tcp, 23132/tcp, 27374/tcp, 29364/tcp, 31336/tcp, 31337/tcp, 45454/tcp, 47017/tcp, 47889/tcp, 60001/tcp).
(note
or another program)
A search of the chkrootkit-users mailing list archive at
http://marc.info/?l=chkrootkit-users&r=1&w=2 for "465" produces several comments that chkrootkit will report a false positive if you have any kind of ssmtp server running -- which SME does.
SME comes with
rkhunter pre-installed; do you have a reason to prefer 'chkrootkit'?
1 Replies
952 Views