Mds Error every 4 seconds

Question

Hi, I posted this in a 10.5 (Client) thread, but didn't get any answers there. Since I figured it might be related to OD I'm posting this again over here:
I took a look into the console due to something unrelated and noticed this error message flooding the console every 4 seconds!
14.08.08 10:30:20 mds22 (Error) Import: importer:0x85f400 Importer start failed for 1028 (kr:268435459 (ipc/send) invalid destination port)
14.08.08 10:30:24 mds22 (Error) Import: importer:0x85f400 Importer start failed for 1028 (kr:268435459 (ipc/send) invalid destination port)
14.08.08 10:30:28 mds22 (Error) Import: importer:0x85f400 Importer start failed for 1028 (kr:268435459 (ipc/send) invalid destination port)
14.08.08 10:30:32 mds22 (Error) Import: importer:0x85f400 Importer start failed for 1028 (kr:268435459 (ipc/send) invalid destination port)
I only copied 4 of them here so you can see that it's exactly the same message. There's ~4000(!) of these entries for just the last 2 days. I believe it has something to do with metadata, but don't know where to start solving it.
As always, any help is appreciated!
Björn
PS: 1028 is the user id of an Open Directory account. This user is sometimes logged in on my Mac, but its home is on the 10.5 Server, if that helps...

Answer 1

Well, this is a bit off topic for this forum category, not to mention that I found this out by a screw-up, but....
When Apple dumb-downed Leopard' s Firewall GUI (from Tiger) into an Application Firewall (see http://support.apple.com/kb/HT1810) to make it user friendly (i.e, very Microsofty-ish) they also crippled the GUI's ability to configure it, so I looked into alternatives to tighten security. Fortunately, Apple uses ipfw, which is extremely configurable (see http://macsecure.com/2007/11/09/managing-the-leopard-firewall-with-waterroof/ )... which leads me to how I found out the messages described in the post were most likekely a hack attempt.
I wanted to add firewall rules that would only allow access to workstations from our servers, and SSH access only from our subnet, but I screwed up one of the rules, which in turn negated the processing of all the following rules... Duh....
My plan for testing the firewall was to leave one machine running continuously for several days, exposed to the internet, and logging all ip activity.
Fortunately the rule that says log all ip activity was not negated so when I checked the machine a few days later its firewall log was full of stuff and included hundreds of of the the following entries.
System Log
Aug 19 10:15:32 cleveland mds[33]: (Error) Import: importer:0x869e00 Importer start failed for 1024 (kr:268435459 (ipc/send) invalid destination port)
Aug 19 10:16:02: --- last message repeated 7 times ---
Aug 19 10:16:04 cleveland mds[33]: (Error) Import: importer:0x869e00 Importer start failed for 1024 (kr:268435459 (ipc/send) invalid destination port)
Aug 19 10:16:34: --- last message repeated 7 times ---
Security Log
Aug 19 10:16:00 cleveland com.apple.SecurityServer[21]: Failed to authorize right system.login.tty by client /usr/sbin/sshd for authorization created by /usr/sbin/sshd.
Aug 19 10:16:00 cleveland sshd[5441]: Failed password for invalid user root from 123.138.17.35 port 36360 ssh2
Aug 19 10:16:04 cleveland com.apple.SecurityServer[21]: checkpw() returned -2; failed to authenticate user root (uid 0).
Aug 19 10:16:04: --- last message repeated 1 time ---
Aug 19 10:16:04 cleveland com.apple.SecurityServer[21]: Failed to authorize right system.login.tty by client /usr/sbin/sshd for authorization created by /usr/sbin/sshd.
Aug 19 10:16:04 cleveland sshd[5444]: Failed password for invalid user root from 123.138.17.35 port 36931 ssh2
Aug 19 10:16:08 cleveland com.apple.SecurityServer[21]: checkpw() returned -2; failed to authenticate user root (uid 0).
Aug 19 10:16:08: --- last message repeated 1 time ---
Firewall Log
Aug 19 10:16:00 cleveland Firewall[47]: Allow sshd-keygen-wrapper connecting from 123.138.17.35:36931 uid = 0 proto=6
Aug 19 10:16:05 cleveland Firewall[47]: Allow sshd-keygen-wrapper connecting from 123.138.17.35:38086 uid = 0 proto=6
Aug 19 10:16:09 cleveland Firewall[47]: Allow sshd-keygen-wrapper connecting from 123.138.17.35:39126 uid = 0 proto=6
Aug 19 10:16:13 cleveland Firewall[47]: Allow sshd-keygen-wrapper connecting from 123.138.17.35:40307 uid = 0 proto=6
Luckily I saw what was happening and corrected the rule that screwed things up.