Thu, 24 Oct 2013 09:05:10 +0000 Hi After upgrade from Debian Squeeze til Debian Wheezy, but still running Debian Squeeze kernels Linux dkVserver 2.6.32-5-vserver-amd64 #1 SMP Mon Sep 23 23:03:09 UTC 2013 x86 64 GNU/Linux ii util-vserver 0.30.216-pre2864 amd64 user-space tools for Linux-VServer virtual private s rkhunter now warns about hidden ports. Warning: Hidden ports found: Port number: TCP:139 Port number: TCP:2401 Port number: TCP:25 Port number: TCP:3306 Port number: TCP:35619 Port number: TCP:3690 Port number: TCP:39820 Port number: TCP:40469 Port number: TCP:41162 But netstat shows nothing root@dkVserver:/tmp# netstat -a -p -n Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:1040 0.0.0.0:* LISTEN 3308/inetd tcp 0 0 192.168.123.219:22 0.0.0.0:* LISTEN 11307/sshd tcp 0 0 192.168.123.220:22 0.0.0.0:* LISTEN 11307/sshd tcp 0 0 192.168.123.219:22 192.168.124.17:63462 ESTABLISHED 7780/sshd: jonbendt tcp 0 0 192.168.123.219:22 192.168.124.17:63936 ESTABLISHED 31612/sshd: jonbend tcp 0 0 192.168.123.220:40255 192.168.123.9:3493 ESTABLISHED 3480/upsmon tcp 0 103300 192.168.123.219:22 192.168.123.249:38231 ESTABLISHED 13710/sshd: root@no tcp 0 0 192.168.123.220:40254 192.168.123.9:3493 ESTABLISHED 3480/upsmon udp 0 0 192.168.123.225:123 0.0.0.0:* 3383/ntpd udp 0 0 192.168.123.3:123 0.0.0.0:* 3383/ntpd udp 0 0 192.168.123.218:123 0.0.0.0:* 3383/ntpd udp 0 0 192.168.123.220:123 0.0.0.0:* 3383/ntpd udp 0 0 192.168.123.232:123 0.0.0.0:* 3383/ntpd udp 0 0 192.168.123.245:123 0.0.0.0:* 3383/ntpd udp 0 0 192.168.123.239:123 0.0.0.0:* 3383/ntpd udp 0 0 192.168.123.248:123 0.0.0.0:* 3383/ntpd udp 0 0 192.168.123.241:123 0.0.0.0:* 3383/ntpd udp 0 0 192.168.123.219:123 0.0.0.0:* 3383/ntpd udp 0 0 127.0.0.1:123 0.0.0.0:* 3383/ntpd udp 0 0 0.0.0.0:123 0.0.0.0:* 3383/ntpd udp6 0 0 fe80::230:48ff:febe:123 :::* 3383/ntpd udp6 0 0 fe80::230:48ff:febe:123 :::* 3383/ntpd udp6 0 0 ::1:123 :::* 3383/ntpd udp6 0 0 :::123 :::* 3383/ntpd Active UNIX domain sockets (servers and established) Proto RefCnt Flags Type State I-Node PID/Program name Path unix 11 [ ] DGRAM 9647 3148/rsyslogd /dev/log unix 2 [ ACC ] SEQPACKET LISTENING 4546 941/udevd /run/udev/control unix 2 [ ] DGRAM 16744189 7016/sudo unix 2 [ ] DGRAM 16744186 7016/sudo unix 3 [ ] STREAM CONNECTED 16736746 31612/sshd: jonbend unix 3 [ ] STREAM CONNECTED 16736745 31871/0 unix 2 [ ] DGRAM 16736744 31612/sshd: jonbend unix 2 [ ] DGRAM 16084282 7875/sudo unix 2 [ ] DGRAM 16084279 7875/sudo unix 3 [ ] STREAM CONNECTED 16084158 7780/sshd: jonbendt unix 3 [ ] STREAM CONNECTED 16084157 7784/1 unix 2 [ ] DGRAM 16084156 7780/sshd: jonbendt unix 2 [ ] DGRAM 2535205 13710/sshd: root@no unix 2 [ ] DGRAM 17968 5521/login unix 2 [ ] DGRAM 9991 3480/upsmon unix 2 [ ] DGRAM 9979 3478/upsmon unix 2 [ ] DGRAM 9817 3383/ntpd unix 3 [ ] DGRAM 4553 941/udevd unix 3 [ ] DGRAM 4552 941/udevd root@dkVserver:/tmp# I have no firewalls root@dkVserver:/tmp# iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination root@dkVserver:/tmp# iptables -L -n -t nat Chain PREROUTING (policy ACCEPT) target prot opt source destination Chain POSTROUTING (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination root@dkVserver:/tmp# root@dkVserver:/tmp# ifconfig eth0 Link encap:Ethernet HWaddr 00:30:48:be:d3:48 inet addr:192.168.123.219 Bcast:192.168.123.255 Mask:255.255.255.0 inet6 addr: fe80::230:48ff:febe:d348/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:17630380 errors:0 dropped:0 overruns:0 frame:0 TX packets:195781630 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:3540039829 (3.2 GiB) TX bytes:250631589145 (233.4 GiB) Interrupt:17 Memory:fdae0000-fdb00000 eth1 Link encap:Ethernet HWaddr 00:30:48:be:d3:49 inet addr:192.168.123.220 Bcast:192.168.123.255 Mask:255.255.255.0 inet6 addr: fe80::230:48ff:febe:d349/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:182495083 errors:2 dropped:0 overruns:0 frame:2 TX packets:311134770 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:23293032621 (21.6 GiB) TX bytes:441373993794 (411.0 GiB) Interrupt:18 Memory:fdbe0000-fdc00000 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:34266 errors:0 dropped:0 overruns:0 frame:0 TX packets:34266 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:7049817 (6.7 MiB) TX bytes:7049817 (6.7 MiB) And the worst part of the problem is that the open ports changes :-( root@dkVserver:/tmp# diff rkhunter--check.1382604945 rkhunter--check.1382605001 21c21 < Port number: TCP:54668 --- > Port number: TCP:54671 root@dkVserver:/tmp# diff rkhunter--check.1382604945 rkhunter--check.1382605186 8,9c8,11 < Port number: TCP:40407 < Port number: TCP:41099 --- > Port number: TCP:39820 > Port number: TCP:40469 > Port number: TCP:41162 > Port number: TCP:41627 10a13 > Port number: TCP:42991 12a16 > Port number: TCP:44264 19c23 < Port number: TCP:52358 --- > Port number: TCP:52419 21c25 < Port number: TCP:54668 --- > Port number: TCP:54707 23,24c27,28 < Port number: TCP:56228 < Port number: TCP:56954 --- > Port number: TCP:56291 > Port number: TCP:60814 So I cant even whitelist them. JonB