as part of the process of securing a debian box, I've closed every port that was open except 22 for ssh. I ran nmap on this computer a few days ago and discovered that port 515 was open. So, I ran /etc/rc2.d/s20lpd stop and that closed it. But yesterday I checked again and the lpd port was open again.

So my question is, how can I go about tracking down whatever it is that's starting the printer daemon?

I have renamed the startup script from S20lpd to s20lpd so it wont restart if the machine reboot - but this computer has actually been up for 60 days
I am running in X, so the only thing I can think of is that some program is trying to print and that's starting the demon.

thanks in advance for any advice.

port 515 opened itself again this weekend. lsof -i :515 shows that it is /usr/sbin/lpd listening (I was worried that the machine might have been hacked).

Can anyone offer any suggestions on how I might track down what's starting this service? The machine has not been rebooted since the last time I shut down the service. I've looked for cron jobs an anything else that I could think of but I haven't had any luck figuring it out. So, any ideas would be greatly appreciated.

Over the weekend, I left an account logged into an X session with just mozilla and an xterm running. Could X be starting the printer daemon?

I'm going to indulge myself with a single bump.

Maybe if nobody can help me someone can point me to another place to ask this question.