Re: Possible security problem?

In article <%GMFe.639$Bw6.4995@nnrp1.ozemail.com.au>,
 Tony Cameron <Darkscribe01@hotmail.com> wrote:

> I am running a Mac G5 with 10.3.9 and have just discovered that at
> regular but intermittent intervals, several times an hour, the process
> nmbd attempts to make a UDP contact with a wide variety of addresses
> mostly US based, but some European, on various ports ranging from 135 to
> 62253.
>
> I run Firewalk X2 but have not worried in the past about what apps and
> processes were getting out, just incoming, but turned logging on the
> other day and discovered this consistent communication. I have blocked
> nmbd for the moment, with no apparent ill effects, but I am very curious
> as to the reason behind it. I don't see how I could have been hacked,
> but it does look suspicious.
>
> This occurs regardless of the apps running at the time, even after
> rebooting and with nothing aside from system services started. I do have
> Virtual PC on the system, but even with it not started, or killing it
> from the activity monitor makes no difference to the activity. Samba is
> not running.
>
> Can anybody shed some light on this? Google doesn't seem to offer much
> in the way of explanation.
>

Nnbd is part of the samba PC file sharing suite. If you don't need
samba, turn off "Windows Sharing" in the Sharing System Preferences
pane. If you need samba, but want to restrict its activities, read up
on the configuration options in the man page for smb.conf.

-- 
Tom Stiller
PGP fingerprint =  5108 DDB2 9761 EDE5 E7E3 
                   7BDA 71ED 6496 99C0 C7CF