An LDAP server on another is reporting an unusually large number of attempts to read the LDAP directory, all of which look like hacking attempts to read user/password information. It reports that the originating IP is a Mac OS X server. I log into the Mac OS X server, run
ps -A but it does nothing looks suspicious. Is there a way to see what the Mac OS X ldap client is doing?
I need to disable this malicious script, but I cannot disable the LDAP client completely, as users rely on this server for file storage and user ids.