Am 18.03.2014 16:09, schrieb Ben Johnson: > A daily rkhunter scan produced the following warning, which mentions Postfix. > Is this a false-positive? > > Warning: Network TCP port 47107 is being used by /usr/lib/postfix/proxymap. > Possible rootkit: T0rn > Use the 'lsof -i' or 'netstat -an' command to check this
these are mostly false positives and that ports are the local port of a connection form the named process, any TCP connection has a non-privileged local port above 1024
