[Users] rkhunter with claws

Colin Leroy-Mira colin at colino.net
Mon Mar 18 10:38:57 CET 2019

On Fri, 15 Mar 2019 18:38:18 +0100, cavelier
<jean-jacques.cavelier2 at wanadoo.fr> wrote:

> Hi.
> Watch what rkhunter said to me about claws.
> Network TCP port 60922 is being used by /usr/local/bin/claws-mail.
> Possible rootkit: zaRwT.KiT
> True???

I think rkhunter reports client ports too, I guess it's just a network
connection to a mail server.

You can check using:
sudo netstat -nap | grep claws-mail

You shouldn't have any LISTEN connections but that's normal to have
ESTABLISHED connections.

More information about the Users mailing list