False Positive: IRCDs running on port 6667

[Thomas Ward]

Binary package hint: chkrootkit

This program detects falsely an infection on port 6667. This is the case with an IRCD running on port 6667 being detected as bindshell.

This is a bug, but also could the documentation on false positives be amended to include the info about ircds also triggering false positives?

System Info: Ubuntu 10.04 Lucid Lynx, both 32-bit and 64-bit server editions (multiple servers)

[Clint Byrum (clint-fewbar)]

Hi TrekCaptainUSA, thanks so much for taking the time to report this bug and help us make Ubuntu better!

I tried this on a fresh install of lucid, indeed if you just do 'apt-get install ircd-hbrid chkrootkit' and run chkrootkit, bindshell is falsely detected. Marking Confirmed.

Setting Importance to Medium. While this is a bug, its only a problem for users who have installed an irc daemon, which is not a common use case.

[Thomas Ward (teward)]

Perhaps a separate optional -doc package for possible server-related false positives, or perhaps a chkrootkit.SERVER-FALSE-POSITIVES doc? Just an opinion.

Thank you though for quickly processing this bug report.