/usr/lib/python3/dist-packages/ansible_collections/cyberark/conjur/usr/share/doc/chkrootkit/README.FALSE-POSITIVES.gz
says:

** use of well-known ports
   Some rootkits are known to listen on common ports that are also
   used by legitimate services. chkrootkit flags any such processes as
   suspicious, without further investigation. Because the bindshell
   rootkit listens on many ports, there can be many false positives
   from this test - there are too many to list in this file, but
   mosh(1) may trigger this. You can check what is running using ss(1)
   or netstat(1).

but it doesn't say how to avoid the issue, e.g. how to filter the
output, which is rather complex in the case of bindshell, due to
the multiline output (and incomplete information, if one wants to
do it right).

It is difficult to regard
----
Checking `bindshell'...                                     not found
----

and

----
Checking `bindshell'...                                     WARNING

WARNING: Potential bindshell installed: infected ports: 60001

----

as equivalent with filtering.

I suppose that the right solution is to change the bindshell
parameters, e.g. using the -anp option for ss and filter the
ss output, but I could not find how: the $netstat and $OPT values
seem to be hardcoded in /sbin/chkrootkit, so that it is not
possible to override them in /etc/chkrootkit/chkrootkit.conf.
For instance, one should be able to use

  { /usr/bin/ss -anp | /usr/bin/grep -v '^udp.*:60001[[:space:]].*"mosh-server"'; }

instead of

  ${netstat} "${OPT}"

I think this is probably possible with a filter - even sed can
consider multiple lines if you try hard enough, but indeed, not
simple.


Indeed  ---  $netstat and $OPT are implementation details  - you
wouldn't be able to put a pipe in a variable anyway.

It would technically work to use -p and provide a custom 'ss' command
that runs that pipeline: you'd also need to provide copies of
everything else in $cmdlist -- perhaps it would works to use symlinks.

But i suppose there could be a separate option to exclude things from
this check: the options are:
- an option to change the range of ports that are checked (ie to
change $PORT to a list that does not include 6001): easy, but it would
be a blanket "dont check that port"
- an option to do custom filtering of the results --  this would be
likely be limited eg, to one word arguments to grep

I think this is probably possible with a filter - even sed can
consider multiple lines if you try hard enough, but indeed, not
simple.


Indeed  ---  $netstat and $OPT are implementation details  - you
wouldn't be able to put a pipe in a variable anyway.

It would technically work to use -p and provide a custom 'ss' command
that runs that pipeline: you'd also need to provide copies of
everything else in $cmdlist -- perhaps it would works to use symlinks.

But i suppose there could be a separate option to exclude things from
this check: the options are:
- an option to change the range of ports that are checked (ie to
change $PORT to a list that does not include 6001): easy, but it would
be a blanket "dont check that port"
- an option to do custom filtering of the results --  this would be
likely be limited eg, to one word arguments to grep

eval the variable or chkrootkit could be modified to source a config
file (just like what chkrootkit-daily already does), in which case
the user could define shell functions (where there could be the pipe).

This would be an easy solution, though limited.

That and being able to override OPT (e.g. by setting BINDSHELL_OPT)
would be interesting.