Question magicspam and rkhunter

[Franco]

Hello,
I am running Plesk Onyx latest MU on CentOS 7.
About a week ago I started to receive daily warning from rkhunter:

"Warning: The following suspicious shared memory segments have been found:
Process: PID: 1107 Owner: magicspam
Process: /usr/sbin/httpd PID: 13267 Owner: root
Process: PID: 18617 Owner: root
"

I am not running email services on my VPS and magicspam was there and I never bothered to configured it, let alone buy the license. It was left as installed by the hosting company, I presume. As it was for docker as well.
Why suddenly do i get those warnings? Is it normal or should I worry? Is this a sign that something else is wobbly? Any suggestion, please?

Best rergards

 

[UFHH01]

Hi Franco,

Any suggestion, please?

if you don't use a Plesk component on your server, there is no need to leave it installed on your server. Pls. consider to REMOVE components, if you don't need/use them on your server.

Is this a sign that something else is wobbly?

This only indicates, that there might be an unfnished update/upgrade/patch, which you should correct by de- and re-installing the corresponding compoenent for example - but due to the fact that you don't use MagicSpam anyway, just remove the component from your server, to get rid of the false WARNING ( which is not an error... just a WARNING! ).

 

[Franco]

Thanks a lot, UFHH01, I followed your advice and removed magicspam.
The latest run, however, still shows:

"Warning: The following suspicious shared memory segments have been found:
Process: /usr/sbin/httpd PID: 17326 Owner: root"

which, I guess, was unrelated to magicspam. Same process, but different PID than the day before. Do you have any suggestion for that, please?

Regards

 

[IgorG]

Looks like this rkhunter bug - Bug 1472299 – rkhunter finds suspicious shared segments in evolution and xfce4-terminal