它看起来像有人使用我的Mac OS X服务器蛮力攻击另一个服务器是LDAP。 我能做些什么来阻止它？

另一台LDAP服务器报告尝试读取LDAP目录并尝试多个用户的尝试exception频繁，所有这些尝试都像是黑客试图读取用户/密码信息。 这些每分钟都会发生。 它报告说，原始IP是Mac OS X 10.4 Tiger Server，它是networking上用于iMac的文件服务器。

当我在Mac服务器上运行lsof -i:ldap +c 0时，它会返回

 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME DirectoryService 60 root 11u IPv4 0x38de228 0t0 TCP mymacserver.com:50106->myldapserver.com:ldap (ESTABLISHED) 

运行ps -Aj给出

 USER PID PPID PGID SESS JOBC STAT TT TIME COMMAND [...] root 60 1 60 290c7e4 0 Ss ?? 0:19.00 /usr/sbin/DirectoryService 

运行cat /Library/Logs/DirectoryService/DirectoryService.server.log给出

• 使用LDAP授权的Apache Kerberos身份validation：访问/失败，原因：require指令存在，没有权威处理程序
• Bugzilla LDAP Server2008
• 在GUI外部更改WAS上的LDAP设置
• 两个samba服务器和UID，GID映射
• 使用OpenLDAP的元后端将传入的用户映射到其他人

 2012-02-15 15:01:29 EST - DirectoryService 2.1 (v353.6) starting up... 2012-02-15 15:01:29 EST - Initializing TCP ... 2012-02-15 15:01:29 EST - Plugin <Configure>, Version <1.7>, processed successfully. 2012-02-15 15:01:29 EST - Plugin <NetInfo>, Version <1.7.4>, processed successfully. 2012-02-15 15:01:29 EST - Plugin <LDAPv3>, Version <1.7.4>, processed successfully. 2012-02-15 15:01:29 EST - Plugin <Search>, Version <1.7>, processed successfully. 2012-02-15 15:01:29 EST - Plugin "Active Directory", Version "1.5.8", is set to load lazily. 2012-02-15 15:01:29 EST - Plugin "AppleTalk", Version "1.3", is set to load lazily. 2012-02-15 15:01:29 EST - Plugin "Bonjour", Version "1.3", loaded successfully. 2012-02-15 15:01:29 EST - Plugin "BSD", Version "1.2.2", is set to load lazily. 2012-02-15 15:01:29 EST - Plugin "PasswordServer", Version "3.1.2", is set to load lazily. 2012-02-15 15:01:29 EST - Plugin "SLP", Version "1.3.1", is set to load lazily. 2012-02-15 15:01:29 EST - Plugin "SMB", Version "1.3", is set to load lazily. 2012-02-15 15:01:29 EST - Registered node /Configure 2012-02-15 15:01:29 EST - Registered node /Search 2012-02-15 15:01:29 EST - Plug-in Configure state is now active. 2012-02-15 15:01:29 EST - Registered node /Search/Contacts 2012-02-15 15:01:29 EST - Registered node /Search/Network 2012-02-15 15:01:29 EST - Plug-in Bonjour state is now active. 2012-02-15 15:01:29 EST - Plug-in Search state is now active. 2012-02-15 15:01:29 EST - Plug-in LDAPv3 state is now active. 2012-02-15 15:01:29 EST - Registered node /NetInfo/DefaultLocalNode 2012-02-15 15:01:29 EST - Plug-in NetInfo state is now active. 2012-02-15 15:01:32 EST - Network transition occurred. 2012-02-15 15:01:35 EST - Registered Locally Hosted Node /NetInfo/DefaultLocalNode 2012-02-15 15:01:41 EST - Network transition occurred. 2012-02-15 15:01:41 EST - Network transition occurred. 2012-02-15 15:01:41 EST - Network transition occurred. 

（时间是几个小时前服务器重新启动的时间。）这已经持续了好几天了。

有没有办法看到什么是每分钟调用DirectoryService？

我不能使用netstat -p ，因为Mac OS X 10.4 Tiger不支持-p选项。

我需要禁用这个恶意脚本，但是我不能完全禁用LDAP客户端，因为用户依靠此服务器来存储文件和用户ID。

编辑：

我运行sudo killall -USR1 DirectoryService来启用debugging日志，看来memberd和lookupd正在调用DirectoryService。