3

While running a local port scan for a troublesome process I discovered a few unknown open ports.

 Open TCP Port:     106         3com-tsmux
 Open TCP Port:     3001        redwood-broker

I believe I know what redwood-broker is for, but the other one not so much..

I began by looking up its PID with:

sudo lsof -i :106

Then killed it with

sudo kill [PID]

But it keeps popping up.

How can I find the path to the files responsible for starting this process?

migrated from security.stackexchange.com Mar 25 '16 at 23:59

This question came from our site for information security professionals.

  • Well, a search engine resulted in this: support.apple.com/en-us/HT202944 – Dave Mar 25 '16 at 22:53
  • Thanks Dave, i actually found the same thing. I would still like to know how to find the files. – BAR Mar 25 '16 at 22:55
  • BAR do you know what redwood-broker is? I see it on my Mac as well and it confuses me. – Nick Dima Sep 27 '17 at 8:51
  • @NickDima Never found out what it was, but the lack of info indicates it is normal, not a threat, and very internal to mac processes. It also has an appleish sounding name though. – BAR Sep 27 '17 at 8:54
3

If the process keeps reappearing then most likely it is started by launchd. Use launchctl to list jobs loaded to launchd:

sudo launchctl list
launchctl list

Job definitions for launchd in .plist files are stored in:

~/Library/LaunchAgents         Per-user agents provided by the user.
/Library/LaunchAgents          Per-user agents provided by the administrator.
/Library/LaunchDaemons         System-wide daemons provided by the administrator.
/System/Library/LaunchAgents   Per-user agents provided by Mac OS X.
/System/Library/LaunchDaemons  System-wide daemons provided by Mac OS X.

You might also grep the above files for actual path to executable.


For all processes you can check the output of ps -ef | grep <process_name> and check the parent process PPID.

  UID   PID  PPID   C STIME   TTY           TIME CMD
  501 17151  7357   0  9:35AM ttys000    0:00.00 grep grep

In this example grep process was spawned from process 7357. Later you can check ps -ef | grep 7357 to find out it was bash process that started grep.

  • Ok i was able to grep the apparent apple process but not the redwood-broker. – BAR Mar 25 '16 at 23:03
  • If it keeps reappearing then most likely launchd is responsible for it. But it doesn't mean any process in the system is controlled by it. ps -ef and check which process it was spawned from. – techraf Mar 25 '16 at 23:20
  • But how would I find the path to the files responsible for redwood-broker? – BAR Mar 26 '16 at 0:01
  • See above comment: ps -ef | grep redwood-broker – techraf Mar 26 '16 at 0:02
1

Apple uses ports 106 and 3659 for its password service (a SASL-based remote authentication service), which is part of its Open Directory domain service. Shutting down the password service will break large parts of the Open Directory domain service (including local authentication to domain accounts).

If you want Open Directory to work, do not shut this down. On the other hand, if you don't want the Open Directory domain, then turn OD itself off (including the LDAP service and its section of Kerberos). On the gripping hand, if you want to use OD but don't want to unnecessarily expose services, then set up firewall rules to limit access to ports 106 and 3659 (and maybe 88, 389, 636, and 749).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .