[Dovecot] rkhunter alert dovecot using port 1984
mark at campbell-lange.net
Tue Mar 8 12:43:09 EET 2011
Debian Lenny, dovecot 1.0.15
My rkhunter script has picked up dovecot using port 1984 temporarily.
When I run it now however, it is gone.
Warning: Network TCP port 1984 is being used by /usr/lib/dovecot/imap.
Possible rootkit: Fuckit Rootkit
Use the 'lsof -i' or 'netstat -an' command to check this.
Does dovecot use this port for any reason? anyone seen this before?
More information about the dovecot