The rkhunter was detected a suspect connection between our hosted confluence and an external server as described below :
Warning: Network TCP port 60922 is being used by /home/confluence/atlassian/confluence/jre/bin/java. Possible rootkit: zaRwT.KiT
The netstat commande give us a connexion between MYIP:60922 and 34.193.88.221:443.
It is normal ??
Hello @smsmode,
Welcome to Atlassian Community. It's nice to have you.
Confluence Server doesn't use port 60922, but I did a search on the error message and that port, and I found some resources online talking about that error message along with rkhunter, and about how the message was a false alarm for them.
Here is one example:
I'm not familiar with rkhunter myself, but perhaps the same is true for the message you're getting?
For a comprehensive list of ports used by Atlassian applications have a look below:
Let us know if you have any questions about this.
Regards,
Shannon
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.