Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to figure out in the rkhunter config how I can whitelist the detection of certain ports, such as ports used for IRCds, and other ports which I have for services which run on non-standard ports.

Does anyone know how to configure this so that rkhunter does not throw warnings about detecting the ports I wish to whitelist?

share|improve this question
up vote 4 down vote accepted

You edit /etc/rkhunter.conf

# command line
sudo -e /etc/rkhunter.conf

# graphical
gksu gedit /etc/rkhunter.conf

Under the WHITELIST_PORTS section , add your whitelist. The configuration file has examples.

# Syntax /full/path/to/binary Protocol:port
# Protocol = TCP / UDP 
# You may use wildcards

PORT_WHITELIST=”/usr/sbin/privoxy TCP:8118″

#for multiple binaries / ports , list them as per the config file
PORT_WHITELIST="/usr/sbin/privoxy /usr/sbin/squid TCP:8118 TCP:3128"

# Alternate
share|improve this answer
well i should have posted to my own question here stating an issue... there actually was a bug in the version I was using many eons ago. Turns out they didnt process the list correctly in that version. 11.04 does not have this bug :P (marked as answer because it does provide the config examples) – Thomas Ward Dec 22 '11 at 22:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.