Home / server / Questions / 942957
Accepted
Steffen
Asked: 2018-12-06 00:47:50 +0800 CST

rkhunter: whitlist for test 'packet_cap_apps'

  • 772

W have here a CentOS 7 server with rkhunter installed. Since yesterday we get following rkhunter warning:

[01:10:30] Info: Starting test name 'packet_cap_apps'
[01:10:30]   Checking for packet capturing applications      [ Warning ]
[01:10:30] Warning: Process '/usr/sbin/NetworkManager' (PID 4654) is listening on the network.

Is there a way to whitelist /usr/sbin/NetworkManager for the packet_cap_apps test?

linux

2 Answers

  1. Best Answer

    In the rkhunter.conf there is an option to disable tests on certain apps with the DISABLE_TESTS parameter where you can add the apps that you don't want to be tested as space separated value. Alternatively you can use SCRIPTWHITELIST option to whitelist /usr/sbin/NetworkManager in case you want to still run tests on packet_cap_apps.

    • 1

  2. You'll want to use the ALLOWPROCLISTEN directive instead of SCRIPTWHITELIST:

    ALLOWPROCLISTEN=/usr/sbin/NetworkManager

    Regards,

    Michael

    • 1