as part of the process of securing a debian box, I've closed every port that was open except 22 for ssh. I ran nmap on this computer a few days ago and discovered that port 515 was open. So, I ran /etc/rc2.d/s20lpd stop and that closed it. But yesterday I checked again and the lpd port was open again.
So my question is, how can I go about tracking down whatever it is that's starting the printer daemon?
I have renamed the startup script from S20lpd to s20lpd so it wont restart if the machine reboot - but this computer has actually been up for 60 days
I am running in X, so the only thing I can think of is that some program is trying to print and that's starting the demon.
thanks in advance for any advice.