Subject: AW: [vserver] AW: rkhunter Warns: Hidden ports found:
From: Fiedler Roman <Roman.Fiedler@ait.ac.at>
Date: Thu, 24 Oct 2013 13:38:41 +0000

 Thu, 24 Oct 2013 13:38:41 +0000
Hi,

> Von: Bendtsen, Jon [mailto:Jon.Bendtsen@laerdal.dk]
> >> Von: Bendtsen, Jon [mailto:Jon.Bendtsen@laerdal.dk]
> >>
> >> After upgrade from Debian Squeeze til Debian Wheezy, but still running
> >> Debian Squeeze kernels
> >> Linux dkVserver 2.6.32-5-vserver-amd64 #1 SMP Mon Sep 23 23:03:09 UTC
> >> 2013 x86 64 GNU/Linux
> >> ii  util-vserver            0.30.216-pre2864 amd64            user-space tools
for
> Linux-
> >> VServer virtual private s
> >>
> >> rkhunter now warns about hidden ports.
> >>
> >> Warning: Hidden ports found:
> >>         Port number: TCP:139
> >>         Port number: TCP:2401
> >>         Port number: TCP:25
> >>         Port number: TCP:3306
> >>         Port number: TCP:35619
> >>         Port number: TCP:3690
> >>         Port number: TCP:39820
> >>         Port number: TCP:40469
> >>         Port number: TCP:41162
> >
> > Could it be, that there are still some shorewall/iptables rules in the way?
> Could you do an iptables-save and send me the output?
> 
> Doubt it. My first post included: ....

OK, so nothing to worry about hooks in mangle, which wouldn't have been included in
your iptables commands.

So perhaps rkhunter is suspecting, that someone has created an own network namespace
to hide ports there. But as I understand it, vserver uses the same feature to separate
the guests. Hence you should have all those ports included when you run e.g.

cd /etc/vserver; ls | while read name; do vserver "${name}" exec netstat -nlp; done

Roman