Topic: rkhunter says eth0 in Promiscious Mode??

[shawnbishop]

Good Day

I decided to run rkhunter as it appears I am losing mail somwhere on the server, and I received this warning

[17:29:09] /sbin/syslogd clean (string: promiscuous)
[17:29:28] Checking network interfaces (promiscuous mode)... [ WARNING ]
[17:29:28] Possible promisc interfaces:
[17:29:28] Output test 2: eth0 in promiscuous mode
[17:29:28] Output test 2: tap0 in promiscuous mode


Why is eth0 in promisious mode, how do I switch it off??

[Daniel B.]

It seems that you are using openvpn in bridge mode. if it's the case, there's nothing to worry about, it's perfectly normal, the two interfaces eth0 and tap0 are enslaved in br0, br0 take the IP of eth0 and becomes the internal interface, then eth0 and tap0 are set in promiscuous mode.

Cheers, Daniel

[shawnbishop]

Thankyou for your response, so no problem then???

Great

[Daniel B.]

No problem, I just don't know how to make rkhunter ignore this warning (I'm not sure if it's possible)