rkhunter found this...

[Kevin J. Cummings]

Daniel B. Thurman wrote:
> Tom Horsley wrote:
>> On Thu, 26 Mar 2009 20:07:54 -0400
>> brian wrote:
>>
>>  
>>>> It means some script somewhere did an rm -f on /dev/null
>>>> then later some other script redirected output to /dev/null
>>>> thus creating it as a regular file.
>>>>         
>>> It looks more like a typo, as another poster said (one L).
>>>     
>>
>> Could be, but I had /dev/null deleted on a machine once and
>> the ensuing fun was really spectacular :-).
>>
>> Doing "whatever > /dev/null" wasn't too bad, but when
>> someone said "whatever < /dev/null" amazingly random things
>> could happen.
>>
>>   
> The point is, it is not MY scripts doing this!  I have had
> this bugger for quite some time on F9 and it does not
> go away!  Grr.  I just deleted it every time rkhunter
> reports it.  Probably just ignore the darn thing....

This information kinda re-enforces that its a typo in a script somewhere.

Is the text really "nsdc:" or is it "nscd:"?  nscd would be the Name 
Service Caching Daemon.

My F9 system exhibits no such behaviour.  Then again, I'm not running 
nscd on my F9 system, instead I'm using named which is running on my F8 
server.

-- 
Kevin J. Cummings
kjchome at rcn.com
cummings at kjchome.homeip.net
cummings at kjc386.framingham.ma.us
Registered Linux User #1232 (http://counter.li.org)