Hi,
thank you for your reply.
Onestly, I don't know if binary is legit. I've no previous md5sum.
I run rkhunter and I've no warning:
# rkhunter --enable packet_cap_apps --nolog --nomow
[ Rootkit Hunter version 1.4.0 ]
Checking the network...
Performing checks on the network interfaces
Checking for packet capturing applications [ None found ]
System checks summary
=====================
File properties checks...
All checks skipped
Rootkit checks...
All checks skipped
Applications checks...
All checks skipped
The system checks took: 1 second
No log file created.
No warnings were found while checking the system.
What do you think?
Thank you
>----Messaggio originale----
>Da: n...@maddler.net
>Data: 26/11/2013 13.15
>A: "absolutely free"<absolutely_f...@libero.it>
>Cc: <rkhunter-users@lists.sourceforge.net>
>Ogg: Re: [Rkhunter-users] Warning on http listening on network
>
>That message refer to packet capture not to "normal" listening.
>So said: are you sure that httpd is the legit one?
>If so, that could be something similar to http://comments.gmane.org/gmane.
comp.documentfoundation.libreoffice.user/23104, perhaps.
>
>W.
>
>----- Original Message -----
>From: "absolutely free" <absolutely_f...@libero.it>
>To: rkhunter-users@lists.sourceforge.net
>Sent: Tuesday, November 26, 2013 11:45:08 AM
>Subject: [Rkhunter-users] Warning on http listening on network
>
>Hi,
>
>I received this warning:
>
>Warning: Process '/usr/local/apache/bin/httpd' (PID 8058) is listening on
the
>network.
>Warning: Process '/usr/local/apache/bin/httpd' (PID 8058) is listening on
the
>network.
>Warning: Process '/usr/local/apache/bin/httpd' (PID 8058) is listening on
the
>network.
>Warning: Process '/usr/local/apache/bin/httpd' (PID 8058) is listening on
the
>network.
>Warning: Process '/usr/local/apache/bin/httpd' (PID 8058) is listening on
the
>network.
>Warning: Process '/usr/local/apache/bin/httpd' (PID 8058) is listening on
the
>network.
>Warning: Process '/usr/local/apache/bin/httpd' (PID 8058) is listening on
the
>network.
>Warning: Process '/usr/local/apache/bin/httpd' (PID 8058) is listening on
the
>network.
>Warning: Process '/usr/local/apache/bin/httpd' (PID 8058) is listening on
the
>network.
>Warning: Process '/usr/local/apache/bin/httpd' (PID 8058) is listening on
the
>network.
>Warning: Process '/usr/local/apache/bin/httpd' (PID 8058) is listening on
the
>network.
>Warning: Process '/usr/local/apache/bin/httpd' (PID 8058) is listening on
the
>network.
>Warning: Process '/usr/local/apache/bin/httpd' (PID 8058) is listening on
the
>network.
>Warning: Process '/usr/local/apache/bin/httpd' (PID 8058) is listening on
the
>network.
>Warning: Process '/usr/local/apache/bin/httpd' (PID 8058) is listening on
the
>network.
>Warning: Process '/usr/local/apache/bin/httpd' (PID 8058) is listening on
the
>network.
>Warning: Process '/usr/local/apache/bin/httpd' (PID 8058) is listening on
the
>network.
>Warning: Process '/usr/local/apache/bin/httpd' (PID 8058) is listening on
the
>network.
>Warning: Process '/usr/local/apache/bin/httpd' (PID 8058) is listening on
the
>network.
>Warning: Process '/usr/local/apache/bin/httpd' (PID 8058) is listening on
the
>network.
>
>I think it's normal that Apache is listening on the network.
>It's a false positive?
>
># rkhunter -V
>Rootkit Hunter 1.4.0
>
># uname -ar
>Linux serverone 2.6.18-371.1.2.el5 #1 SMP Tue Oct 22 12:51:53 EDT 2013
x86_64
>x86_64 x86_64 GNU/Linux
>
># lsb_release -a
>LSB Version: :core-4.0-amd64:core-4.0-ia32:core-4.0-noarch:graphics-4.0-
>amd64:graphics-4.0-ia32:graphics-4.0-noarch:printing-4.0-amd64:printing-4.0-
>ia32:printing-4.0-noarch
>Distributor ID: CentOS
>Description: CentOS release 5.10 (Final)
>Release: 5.10
>Codename: Final
>
>Thankyou
>
>
>------------------------------------------------------------------------------
>Shape the Mobile Experience: Free Subscription
>Software experts and developers: Be at the forefront of tech innovation.
>Intel(R) Software Adrenaline delivers strategic insight and game-changing
>conversations that shape the rapidly evolving mobile landscape. Sign up now.
>http://pubads.g.doubleclick.net/gampad/clk?id=63431311&iu=/4140/ostg.clktrk
>_______________________________________________
>Rkhunter-users mailing list
>Rkhunter-users@lists.sourceforge.net
>https://lists.sourceforge.net/lists/listinfo/rkhunter-users
>
------------------------------------------------------------------------------
Shape the Mobile Experience: Free Subscription
Software experts and developers: Be at the forefront of tech innovation.
Intel(R) Software Adrenaline delivers strategic insight and game-changing
conversations that shape the rapidly evolving mobile landscape. Sign up now.
http://pubads.g.doubleclick.net/gampad/clk?id=63431311&iu=/4140/ostg.clktrk
_______________________________________________
Rkhunter-users mailing list
Rkhunter-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/rkhunter-users
