Ever since I installed asl on Centos 6.2, rkhunter has been sending me warning messages. I finally got around to digging through the logs, and one of the things that it's warning about is a "hidden" port:


[09:54:10] Checking for hidden ports [ Warning ]
[09:54:11] Warning: Hidden ports found:
[09:54:11] Port number: 631

I've googled, and run this:
netstat -anp |grep 631
udp 0 0 0.0.0.0:631 0.0.0.0:* 1063/portreserve

Someone wrote that in Centos when you disable cups, it still does a portreserve. I'm not sure what that is - but is there a way to tell rkhunter to ignore that (if it's a false positive)?

Second warning pertains to a hidden file:
[09:54:23] Checking for hidden files and directories [ Warning ]
[09:54:23] Warning: Hidden file found: /sbin/.cryptsetup.hmac: ASCII text

Again, should I do a custom ignore for this? I just wanted to mention it since this was a fresh installation and maybe the Atomic team wants to build in suppression if these are false positives. Thanks in advance.

Seeing a very similar issue, also running CentOS 6:


After Googling port 783, turns out it is sometimes used by the spamd daemon or hp-alarm-mgr and harmless.

Had similar issue with hidden file, added it to the rkhunter files whitelist after checking it was harmless/FP.

Its actually not a false positive, portreserve is actually hiding the port. And the mechanisms rkhunter has to "detect" that this is legitimate are limited. If you allow this currently then you open the possibility of a piece of malware calling itself "portreserve" to hide ports (and to do so without any warning to the user).

With that said, unless you are using portmap (and unless you are using NFS or some other RPC services then you probably are not), you don't need portreserve. Disable the service (and portmap).

chkconfig portreserve off

chkconfig portmap off

Thanks for input Mike, really useful.
I should have been clearer, that port is blocked in/out via iptables. Edit: service portreserve stop + chkconfig portreserve off does the job even better.
Whitelisting only applied to .cryptsetup.hmac

Ah, my mistake for missing that. Sure we can add that in.

I also see this warning, so +1 for getting it added in.

Thanks

Done. Please upgrade rkhunter from the asl respository.

I ran a yum update and got a 404 on https://www.atomicorp.com/channels/asl- ... x86_64.rpm, which yum says I should update.

Clean your yum cache. Run this as root:

yum clean all

that worked, thanks