Hi, 3 days after starting my potato system lpd started to run. system started Feb 6 ps output: USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 6833 0.0 1.3 1052 412 ? S Feb09 0:00 /usr/sbin/lpd root 6836 0.0 1.5 1076 468 ? S Feb09 0:00 /usr/sbin/lpd or root 6833 0.0 1.3 1052 412 ? S Feb09 0:00 /usr/sbin/lpd root 6836 0.0 1.5 1076 468 ? S Feb09 0:00 \_ /usr/sbin/lpd
lpd is not in startup or any cron job. daemon.log is clean with no evidence of it starting. no apparent rootkits, connections, and last/lastlog is clean. How can this happen? Any ideas? I have bind running on port 53 (everything else is filtered) thanks
