rkhunter warnings postfix-queue

[105547111]

I have started seeing these after the plesk microupdate:

Warning: Network TCP port 47018 is being used by /usr/lib/plesk-9.0/postfix-queue. Possible rootkit: Possible Universal Rootkit (URK) component
********Use the 'lsof -i' or 'netstat -an' command to check this.

How can I supress these or make it use a different port?

Thanks!

 

[IgorG]

Do you mean rkhunter from psa-watchdog module or separate rkhunter?
I have submitted corresponding request to developers.

 

[IgorG]

1. Is very strange for postfix-queue to use port 47018.
I recommend use "chkrootkit" utility or another for check you system. And "netstat -an", "lsof -i" of cause.

2. You can to avoid such messagess if postfix-queue port was defined as 47018 manually.
​ You can add postfix-queue into rkhunter.conf which placed in /usr/local/psa/etc/modules/watchdog
I think you have to add string:

for x86
PORT_WHITELIST="/usr/lib/plesk-9.0/postfix-queue TCP:47018"

for x86_64
PORT_WHITELIST="/usr/lib64/plesk-9.0/postfix-queue TCP:47018"

 

[105547111]

Hi IgorG,

Thanks for the reply and information.

Yesterday I ran killall postfix-queue and it is now running not using port 47018 and it's not triggering warnings from rkhunter.

It must be coincidence it happened to be running there last two days, but after killing it's no longer making rkhunter upset.

Cheers,
David