On a new test iMac (running Mavericks 10.9.2) I discovered 2 repeated errors related to apsd
(Apple Push Notification Service daemon).
Repeated failing connections
A netstat
command displays a huge number of not correctly terminated tcp
connections. All these dead connections are toward a domain at Apple, and using port 5223/tcp
.Actually I have 400 of them:
$ netstat -An
Active Internet connections
Socket Flowhash Proto Recv-Q Send-Q Local Address Foreign Address (state)
[...]
ffffff8024040d88 c23b1438 tcp4 0 0 •••.My_IP.••.50929 17.149.36.133.5223 ESTABLISHED
ffffff8022ef8d88 31793d40 tcp4 0 106 •••.My_IP.••.50604 17.149.32.8.5223 FIN_WAIT_1
ffffff8022cc2d88 c977e8ee tcp4 0 143 •••.My_IP.••.50491 17.172.232.142.522 FIN_WAIT_1
[...]
Repeated invalid certificates
Every each 90 minutes, apsd
is telling it can't recognize a certificate. A large grep
on system.log
logs display this repeated error:
$ zgrep apsd /var/log/system.log.[0-6].gz
[...]
/var/log/system.log.0.gz:May 25 00:48:01 ••.My_name.My_domain.•• apsd[106]: Unrecognized leaf certificate
/var/log/system.log.0.gz:May 25 02:18:22 ••.My_name.My_domain.•• apsd[106]: Unrecognized leaf certificate
/var/log/system.log.0.gz:May 25 03:48:44 ••.My_name.My_domain.•• apsd[106]: Unrecognized leaf certificate
[...]
Related documentation
I found here the way to shut up this daemon:
How to disable Apple Push Notification Service (apsd) on OS X 10.8?
I didn't find here any explanation on how this daemon is working, how it is started or stopped:
man apsd
I found here a correct explanation of the behaviour of apsd
seeing a wrong certificate:
Unrecognized leaf certificate.
Questions
This daemon is clearly misbehaving and typical of many security problems (bad connection, bad certificate validation, data leak…).
How should this daemon work?
Which service is it useful to?
Is this daemon functioning with these repeated misbehaviours?
How may I check it?
How might I have fired this misbehaving daemon?
And finally, shouldn't I stop it definitively?
<code>
doesn't produce a clean output of command lines, log files? – dan May 26 '14 at 15:24