On my server I always install rkhunter by default. Here my whitelists for grommunio for no false positives.

### Grommunio Dienste
#
# Allow the specified process pathnames to use shared memory segments.
#
ALLOWIPCPROC=/usr/libexec/gromox/delivery-queue
ALLOWIPCPROC=/usr/sbin/php-fpm

#
# The following options can be used to whitelist network ports which are known
# to have been used by malware.
#
PORT_PATH_WHITELIST="/usr/libexec/gromox/timer:TCP:6666"

#
# Allow the specified file to be present in the '/dev' directory, and not
# regarded as suspicious.
#
# -rw------- 1 groas grommunio 488 Jul 15 20:56 rhm.d211992fb283c6a90352
ALLOWDEVFILE=/dev/shm/rhm.????????????????????

With this settings there are no warnings:

System checks summary
=====================

File properties checks...
    Files checked: 184
    Suspect files: 0

Rootkit checks...
    Rootkits checked : 380
    Possible rootkits: 0

Applications checks...
    All checks skipped

The system checks took: 1 minute and 22 seconds

All results have been written to the log file: /var/log/rkhunter.log

No warnings were found while checking the system.

© 2020-2024 grommunio GmbH. All rights reserved. | https://grommunio.com | Data Protection | Legal notice