36

Is there a Services.msc or ntsysv utility for OSX? I just want to harden my OSX by disabling any unwanted service and it's ports.

45

The OS X equivalent of Windows services is Launchd. The OS X equivalent of services.msc on Windows is launchctl. The daemons managed by launchd can be on demand or can be triggered periodically (this is configurable in launchd.plist)

You can manage the daemons from the command line (from Terminal.app under /Applications/Utilities/) or by using a tool like Lingon.

From the command line:

  • List agents/jobs loaded using

    launchctl list
    
  • Disable and enable an agent using (persists between boots)

    launchctl enable <name> or launchctl disable <name>
    
  • Stop and start an agent immediately using

    launchctl kickstart <name> or launchctl kill <name>
    

The next commands are deprecated commands, which you might see on the Internet:

  • Remove an agent/job using

    launchctl remove <name>
    
  • Disable an agent/job for the currently booted session alone using

    launchctl unload <name>
    
  • Load an agent/job manually using

    launchctl load <name>
    

Additional references:

  • So effectively Launchd is the init.d equivalent and launchctl something like ntsysv? – polyglot Oct 21 '13 at 11:51
  • Yes, but launchctl is a command line tool (intended to be used from a terminal shell), unlike ntsysv that provides a graphical list. – M K Oct 21 '13 at 12:23
  • I am still finding it very hard to understand how Agents and Daemons work. I think that Daemons are more closer to Services. Are all Daemons work on Demand? meaning that they will only enable them selves when called by a program and then close, something like ssh. However, how can I figure out which Daemons/Agents are live and exposing their ports? Should I run Netstat and then disable those Daemons if not needed? – polyglot Oct 22 '13 at 8:04
  • The terms daemons and agents are sometimes used interchangeably. Per Apple's documentation, daemons cover system and user processes while agents are more about user processes. The daemons managed by launchd can be on demand or can be triggered periodically (this is configurable in launchd.plist). – M K Oct 22 '13 at 8:42
  • Use the command listed above - launchctl list to see the list of daemons. You can also use Activity Monitor to see all processes. Most of them use a convention of ending the name with "d", like launchd, syslogd and so on. – M K Oct 22 '13 at 8:47
1

note that for the MacOS 10.13, you need to use launchctl disable system/ this will stop the process, but would keep the definition in the system folder.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .