Suspected connection between our hosted server and atlassian server

Question

The rkhunter was detected a suspect connection between our hosted confluence and an external server as described below :

Warning: Network TCP port 60922 is being used by /home/confluence/atlassian/confluence/jre/bin/java. Possible rootkit: zaRwT.KiT

The netstat commande give us a connexion between MYIP:60922 and 34.193.88.221:443.

It is normal ??

Shannon S · Answer

Hello @smsmode,

Welcome to Atlassian Community. It's nice to have you.

Confluence Server doesn't use port 60922, but I did a search on the error message and that port, and I found some resources online talking about that error message along with rkhunter, and about how the message was a false alarm for them.

Here is one example:

* AskNetsec: [rkhunter] warnings: False Alarm?

I'm not familiar with rkhunter myself, but perhaps the same is true for the message you're getting?

For a comprehensive list of ports used by Atlassian applications have a look below:

* Ports used by Atlassian applications

Let us know if you have any questions about this.

Regards,

Shannon