On a new test iMac (running Mavericks 10.9.2) I discovered 2 repeated errors related to
apsd (Apple Push Notification Service daemon).
Repeated failing connections
netstat command displays a huge number of not correctly terminated
tcp connections. All these dead connections are toward a domain at Apple, and using port
5223/tcp.Actually I have 400 of them:
$ netstat -An Active Internet connections Socket Flowhash Proto Recv-Q Send-Q Local Address Foreign Address (state) [...] ffffff8024040d88 c23b1438 tcp4 0 0 •••.My_IP.••.50929 22.214.171.124.5223 ESTABLISHED ffffff8022ef8d88 31793d40 tcp4 0 106 •••.My_IP.••.50604 126.96.36.199.5223 FIN_WAIT_1 ffffff8022cc2d88 c977e8ee tcp4 0 143 •••.My_IP.••.50491 188.8.131.52.522 FIN_WAIT_1 [...]
Repeated invalid certificates
Every each 90 minutes,
apsd is telling it can't recognize a certificate. A large
system.log logs display this repeated error:
$ zgrep apsd /var/log/system.log.[0-6].gz [...] /var/log/system.log.0.gz:May 25 00:48:01 ••.My_name.My_domain.•• apsd: Unrecognized leaf certificate /var/log/system.log.0.gz:May 25 02:18:22 ••.My_name.My_domain.•• apsd: Unrecognized leaf certificate /var/log/system.log.0.gz:May 25 03:48:44 ••.My_name.My_domain.•• apsd: Unrecognized leaf certificate [...]
I found here the way to shut up this daemon:
I didn't find here any explanation on how this daemon is working, how it is started or stopped:
I found here a correct explanation of the behaviour of
apsd seeing a wrong certificate:
This daemon is clearly misbehaving and typical of many security problems (bad connection, bad certificate validation, data leak…).
How should this daemon work?
Which service is it useful to?
Is this daemon functioning with these repeated misbehaviours?
How may I check it?
How might I have fired this misbehaving daemon?
And finally, shouldn't I stop it definitively?