Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'm trying to figure out in the rkhunter config how I can whitelist the detection of certain ports, such as ports used for IRCds, and other ports which I have for services which run on non-standard ports.

Does anyone know how to configure this so that rkhunter does not throw warnings about detecting the ports I wish to whitelist?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

You edit /etc/rkhunter.conf

# command line
sudo -e /etc/rkhunter.conf

# graphical
gksu gedit /etc/rkhunter.conf

Under the WHITELIST_PORTS section , add your whitelist. The configuration file has examples.

# Syntax /full/path/to/binary Protocol:port
# Protocol = TCP / UDP 
# You may use wildcards

PORT_WHITELIST=”/usr/sbin/privoxy TCP:8118″

#for multiple binaries / ports , list them as per the config file
PORT_WHITELIST="/usr/sbin/privoxy /usr/sbin/squid TCP:8118 TCP:3128"

# Alternate
PORT_WHITELIST="* TCP:22 TCP:80 TCP:443 TCP:8080"
share|improve this answer
    
well i should have posted to my own question here stating an issue... there actually was a bug in the version I was using many eons ago. Turns out they didnt process the list correctly in that version. 11.04 does not have this bug :P (marked as answer because it does provide the config examples) –  Thomas W. Dec 22 '11 at 22:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.