Subject: Re: [vserver] AW: rkhunter Warns: Hidden ports found:
From: "Bendtsen, Jon" <Jon.Bendtsen@laerdal.dk>
Date: Thu, 24 Oct 2013 12:22:30 +0000

 Thu, 24 Oct 2013 12:22:30 +0000
On 24/10/2013, at 13.55, Fiedler Roman <Roman.Fiedler@ait.ac.at>
 wrote:

> Hi,
> 
>> Von: Bendtsen, Jon [mailto:Jon.Bendtsen@laerdal.dk]
>> 
>> After upgrade from Debian Squeeze til Debian Wheezy, but still running
>> Debian Squeeze kernels
>> Linux dkVserver 2.6.32-5-vserver-amd64 #1 SMP Mon Sep 23 23:03:09 UTC
>> 2013 x86 64 GNU/Linux
>> ii  util-vserver            0.30.216-pre2864 amd64            user-space tools for
Linux-
>> VServer virtual private s
>> 
>> rkhunter now warns about hidden ports.
>> 
>> Warning: Hidden ports found:
>>         Port number: TCP:139
>>         Port number: TCP:2401
>>         Port number: TCP:25
>>         Port number: TCP:3306
>>         Port number: TCP:35619
>>         Port number: TCP:3690
>>         Port number: TCP:39820
>>         Port number: TCP:40469
>>         Port number: TCP:41162
> 
> Could it be, that there are still some shorewall/iptables rules in the way? Could
you do an iptables-save and send me the output?

Doubt it. My first post included:

I have no firewalls

root@dkVserver:/tmp# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
root@dkVserver:/tmp# iptables -L -n -t nat
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
root@dkVserver:/tmp# 




JonB