Re: suspicious lpd started
On February 11, 2003 02:01 pm, Beach, Ken wrote:
> From: Bill [mailto:bill07@shaw.ca]
>
> > I just want to add lpd is not listening on any port according to
> > lsof or netstat
> >
> > On February 11, 2003 11:57 am, bill07@shaw.ca wrote:
> > > Hi,
> > >
> > > 3 days after starting my potato system lpd started to run.
> > > system started Feb 6
> > > ps output:
> > > USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
> > > root 6833 0.0 1.3 1052 412 ? S Feb09 0:00
> > > /usr/sbin/lpd root 6836 0.0 1.5 1076 468 ? S Feb09
> > > 0:00 /usr/sbin/lpd or
> > > root 6833 0.0 1.3 1052 412 ? S Feb09 0:00 /usr/sbin/lpd
> > > root 6836 0.0 1.5 1076 468 ? S Feb09 0:00 \_
> > > /usr/sbin/lpd
> > >
> > >
> > > lpd is not in startup or any cron job. daemon.log is clean
> > > with no evidence of it starting. no apparent rootkits,
> > > connections, and last/lastlog is clean. How can this happen?
> > > Any ideas? I have bind running on port 53 (everything else is
> > > filtered)
> > >
> > > thanks
>
> I'm sure you've already checked it, because you said it's not any
> cron job, but by default lpr is stopped and restarted during log
> rotation. The default debian install puts an ldr in cron.weekly.
>
> Worth a thought anyway...
>
> Cheers,
> Ken
Thank you Ken,
You were right! I overlooked that lpr file. Sorry for the paranoia.
Reply to: