Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

Remote procedure calls are considered to be a security risk. Is there a way for me to disable RPCs on OS X to make my Mac more secure?

share|improve this question
1  
What is RPC? Some clarification might be helpful so we know what you're talking about. –  CajunLuke Dec 6 '11 at 22:31

1 Answer 1

Here are my recommended settings for locking down your Mac. I'm assuming you're running OS X Lion. If that's not the case, let me know and I'll try to adjust my answer for other versions of OS X.

Turn your Firewall on: System Preferences -> Security & Privacy Tab Settings -> Firewall tab. Make sure it's on and that you click the lock in the lower left corner to prevent changes without an administrator's password.

Firewall On

Turn off all sharing services: System Preferences -> Sharing Settings -> Make sure all the stuff in that window is unchecked. Make sure the lock in the lower left corner is locked to prevent changes without an administrator's password.

All sharing services off

Turn off Bonjour (mDNSResponder): For OS Lion you don't need to completely disable mDNSResponder (which is good because if you disable it completely you lose DNS in Snow Leopard and newer OS X). Instead you can follow these steps to disable just Bonjour features in mDNSResponder (Note: do this carefully as a malfunctioning mDNSResponder service can prevent a Mac from booting. Make sure you have a TimeMachine backup before making changes and that booting to your recovery partition works.):

  1. Make a back up copy of the mDNSResponder.plist file as a precaution.
  2. Open the mDNSResponder.plist file in Terminal using your preferred text editor. Here is a sample command:

    sudo nano “/System/Library/LaunchDaemons/com.apple.mDNSResponder.plist”
    
  3. Add <string>-NoMulticastAdvertisements</string> to the array in the ProgramArguments section. In other words:

    <key>ProgramArguments</key>
    <array>
    <string>/usr/sbin/mDNSResponder</string>
    <string>-launchd</string>
    </array>
    

    becomes…

    <key>ProgramArguments</key>
    <array>
    <string>/usr/sbin/mDNSResponder</string>
    <string>-launchd</string>
    <string>-NoMulticastAdvertisements</string>
    </array>
    
  4. Save the file.

  5. Restart your Mac.

You may also want to look at locking down BlueTooth on the system (System Preferences -> BlueTooth Settings). Specifically you may want to uncheck 'Discoverable' so your BlueTooth chipset doesn't advertise itself to other devices nearby. If you're not using any BlueTooth devices consider turning it off altogether.

share|improve this answer
1  
It's worthwhile noting that disabling Bonjour can disable functionality such as iTunes Home Sharing and AirPlay. –  robmathers Dec 7 '11 at 3:51
    
No doubt. All those things use Bonjour to discover each other an then do their work through their RPC interfaces. –  Ian C. Dec 7 '11 at 5:21
    
I encountered some trouble to set this up because I always edited the file using TextMate. DNS resolving would not work anymore. However, once I edited the file with nano it worked...?! –  gentmatt Feb 22 '13 at 8:22
    
@gentmatt that's weird. TM should be friendly for this kind of edit. –  Ian C. Feb 22 '13 at 16:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.