AW: [vserver] AW: rkhunter Warns: Hidden ports found:

From: Fiedler Roman <Roman.Fiedler_at_ait.ac.at>
Date: Thu 24 Oct 2013 - 14:38:41 BST
Message-ID: <2ECE9D9EEF1F524185270138AE2326593BF8870D@S0MSMAIL112.arc.local>

Hi,

> Von: Bendtsen, Jon [mailto:Jon.Bendtsen@laerdal.dk]
> >> Von: Bendtsen, Jon [mailto:Jon.Bendtsen@laerdal.dk]
> >>
> >> After upgrade from Debian Squeeze til Debian Wheezy, but still running
> >> Debian Squeeze kernels
> >> Linux dkVserver 2.6.32-5-vserver-amd64 #1 SMP Mon Sep 23 23:03:09 UTC
> >> 2013 x86_64 GNU/Linux
> >> ii util-vserver 0.30.216-pre2864 amd64 user-space tools for
> Linux-
> >> VServer virtual private s
> >>
> >> rkhunter now warns about hidden ports.
> >>
> >> Warning: Hidden ports found:
> >> Port number: TCP:139
> >> Port number: TCP:2401
> >> Port number: TCP:25
> >> Port number: TCP:3306
> >> Port number: TCP:35619
> >> Port number: TCP:3690
> >> Port number: TCP:39820
> >> Port number: TCP:40469
> >> Port number: TCP:41162
> >
> > Could it be, that there are still some shorewall/iptables rules in the way?
> Could you do an iptables-save and send me the output?
>
> Doubt it. My first post included: ....

OK, so nothing to worry about hooks in mangle, which wouldn't have been included in your iptables commands.

So perhaps rkhunter is suspecting, that someone has created an own network namespace to hide ports there. But as I understand it, vserver uses the same feature to separate the guests. Hence you should have all those ports included when you run e.g.

cd /etc/vserver; ls | while read name; do vserver "${name}" exec netstat -nlp; done

Roman
Received on Thu Oct 24 14:38:48 2013

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Thu 24 Oct 2013 - 14:38:48 BST by hypermail 2.1.8