package rkhunter tags 562588 + pending thanks Hi David,
Le samedi 26 décembre 2009 à 10:13 +0000, David North a écrit : > Package: rkhunter > Version: 1.3.2-6 > Severity: normal > > Since apt-get updating rkhunter to the most recent package, I get the > following false > positive by e-mail each day: > > Warning: Network TCP port 6667 is being used by /usr/bin/znc. Possible > rootkit: Possible rogue IRC bot > Use the 'lsof -i' or 'netstat -an' command to check this. > > ZNC is a legitimate IRC bouncer program and I am using the version > packaged for Debian. > > Ideally, rkhunter would be fixed not to complain about this. Failing > that, we should note the > problem in README.debian along with a workaround, if there is one. Well, actually, rkhunter just warns a daemon listens on TCP port 6667 which is used by IRC bot. To disable this warning, just add the following to your rkhunter.conf file: PORT_WHITELIST="TCP:6667" or better: PORT_WHITELIST="/usr/bin/znc" I have added an entry about this to README.Debian. Cheers, Julien -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
