Public bug reported:
>From a daily mail:
Warning: Network TCP port 47018 is being used by /usr/sbin/squid. Possible
rootkit: Possible Universal
Rootkit (URK) component
Use the 'lsof -i' or 'netstat -an' command to check this.
in this case squid has a high port open, which is quite commonplace for
a proxy.
ProblemType: Bug
DistroRelease: Ubuntu 11.04
Package: rkhunter 1.3.6-5
ProcVersionSignature: Ubuntu 2.6.38-11.48-generic-pae 2.6.38.8
Uname: Linux 2.6.38-11-generic-pae i686
Architecture: i386
Date: Wed Sep 28 09:28:35 2011
PackageArchitecture: all
ProcEnviron:
LANG=en_US.UTF-8
SHELL=/bin/bash
SourcePackage: rkhunter
UpgradeStatus: Upgraded to natty on 2011-04-28 (152 days ago)
** Affects: rkhunter (Ubuntu)
Importance: Undecided
Status: New
** Tags: apport-bug i386 natty
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/861195
Title:
reporting high ports as rootkit
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/rkhunter/+bug/861195/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
