Re: suspicious lpd started
Quoting bill07@shaw.ca <bill07@shaw.ca>:
> Hi,
>
> 3 days after starting my potato system lpd started to run.
> system started Feb 6
> ps output:
> USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
> root 6833 0.0 1.3 1052 412 ? S Feb09 0:00 /usr/sbin/lpd
> root 6836 0.0 1.5 1076 468 ? S Feb09 0:00 /usr/sbin/lpd
> or
> root 6833 0.0 1.3 1052 412 ? S Feb09 0:00 /usr/sbin/lpd
> root 6836 0.0 1.5 1076 468 ? S Feb09 0:00 \_ /usr/sbin/lpd
Notice the little slash widget here ^
This indicates that the second instance was forked by the first (i.e.,
it is a child of the first). Also the PIDs are very close, indicating
that they probably were started at about the same time. A number of
daemons will fork, persisently fork, or pre-fork to allow multiple
simultaneous connections. This is generally more robust (read easier
to get right) than handling multiple connections in one process.
The PID is not particularly low (less than 1-2 thousand). This fits
in with your statement that lpd was not started at boot.
This all looks very normal. Not to guarantee that your box has not
been cracked, but this isn't evidence of it.
Jeffrey
Reply to: