Hi all, Debian Lenny, dovecot 1.0.15 My rkhunter script has picked up dovecot using port 1984 temporarily. When I run it now however, it is gone. Warning: Network TCP port 1984 is being used by /usr/lib/dovecot/imap. Possible rootkit: Fuckit Rootkit Use the 'lsof -i' or 'netstat -an' command to check this. Does dovecot use this port for any reason? anyone seen this before? Regards, Mark
On 8.3.2011, at 12.43, Mark Adams wrote:> Warning: Network TCP port 1984 is being used by /usr/lib/dovecot/imap. > Possible rootkit: Fuckit Rootkit > Use the 'lsof -i' or 'netstat -an' command to check this. > > Does dovecot use this port for any reason? anyone seen this before?No & no.