15

While doing some cleanup of old files on my Mac (macOS 10.12.4, having updated a few days ago) I just discovered a weird file I couldn't find any information on.

In usr/local, there is a folder called remotedesktop with a RemoteDesktopChangeClientSettings.pkg file inside.

drwxr-xr-x  3 root  wheel  102  6 Mär 20:10 remotedesktop
drwxr-xr-x  3 root  wheel  102  6 Mär 20:10 RemoteDesktopChangeClientSettings.pkg

While I know that remote desktop clients have many legitimate use cases, I am a bit worried where this is coming from since I've never used any on this machine.

Is this file a regular part of the OS or a vendor file that was placed there? Should I try and open it?

14

To determine the origin you have several tools at hand:

  • Code signing. Check the code signing of the app/pkg:

    codesign -dv --verbose=4 /usr/local/remotedesktop/RemoteDesktopChangeClientSettings.pkg 
    

    This yields the following:

    Executable=/usr/local/remotedesktop/RemoteDesktopChangeClientSettings.pkg/Contents/Info.plist
    Identifier=com.apple.pkg.RemoteDesktopChangeClientSettings
    Format=installer package bundle
    CodeDirectory v=20100 size=176 flags=0x0(none) hashes=1+3 location=embedded
    Hash type=sha1 size=20
    CandidateCDHash sha1=888c8c6a6abd2f544020594e7d6f4dc31a7e01b8
    Hash choices=sha1
    CDHash=888c8c6a6abd2f544020594e7d6f4dc31a7e01b8
    Signature size=4072
    Authority=Software Signing
    Authority=Apple Code Signing Certification Authority
    Authority=Apple Root CA
    Info.plist entries=24
    TeamIdentifier=not set
    Sealed Resources version=2 rules=12 files=21
    Internal requirements count=1 size=96
    

    Seems legit and (comparing it to other apps) from Apple itself. If the app/pkg was signed by another company at least one of the Authority lines would show a different vendor/developer.

  • Check the receipt bom files:

    grep --include=\*.bom -rnw '/System/Library/Receipts/' -e "RemoteDesktopChangeClientSettings"
    

    which will probably yield:

    Binary file /System/Library/Receipts//com.apple.pkg.RemoteDesktopClient.bom matches
    

    Check the corresponding plist file and you will get the installer package: RemoteDesktopClient 3.9.2. Seems also legit Apple. Now you can lsbom ... the file. See man lsbom.

    A second Receipts folder with non-Apple boms/plists is in the /Library folder!


There are probably some more methods to check if the file is legit or not which I'll try to add later.

  • Wow, thank you for this amazing answer! Not only am I relieved that the file is legit, I am also happy to have something new to learn – determining the source of a file can sometimes be really important to me. – Sven Apr 9 '17 at 17:46
1

I also see a /usr/local/remotedesktop/RemoteDesktopChangeClientSettings.pkg package on my MacBook Pro running macOS 10.13.1 (High Sierra).

$ sw_vers
ProductName:    Mac OS X
ProductVersion: 10.13.1
BuildVersion:   17B1003

$ cd /usr/local/remotedesktop

$ /bin/ls -la
total 0
drwxr-xr-x   3 root  wheel   96 Nov 14 10:34 .
drwxr-xr-x  11 root  wheel  352 Dec 14 15:19 ..
drwxr-xr-x   3 root  wheel   96 Feb 14  2017 RemoteDesktopChangeClientSettings.pkg

I upgraded to High Sierra on November 14th.

Checking the signature using pkgutil, I see that the package has been signed by an untrusted certificate:

$ pkgutil --check-signature RemoteDesktopChangeClientSettings.pkg
Package "RemoteDesktopChangeClientSettings.pkg":
   Status: signed by untrusted certificate
   Certificate Chain:
    1. Software Signing
       SHA1 fingerprint: 22 03 02 9E 85 EF B1 82 8B 92 8C 3B 65 45 F0 03 CC 0E 51 5C
       -----------------------------------------------------------------------------
    2. Apple Code Signing Certification Authority
       SHA1 fingerprint: FA D8 1F 57 1D 72 D2 BA B0 BA B2 17 F9 80 DB 88 03 77 4B 85
       -----------------------------------------------------------------------------
    3. Apple Root CA
       SHA1 fingerprint: 61 1E 5B 66 2C 59 3A 08 FF 58 D1 4A E2 24 52 D1 98 DF 6C 60

On trying to open the package, I see this warning: invalid certificate warning

When I click on the Show Certificate button, I see that the certificate has expired: expired certificate

So, it's probably not advisable to install this version of the RemoteDesktopChangeClientSettings.pkg package :-)

0

It's definitely an Apple component. It remained even after I tried uninstalling my Remote Desktop.app, so I'm guessing it's something the OS may have installed.

I filed an issue with Apple Bugs since /usr/local is meant to be under the user's control and there shouldn't ever be any OS files installed there.

I deleted my /usr/local/remotedesktop folder since it's ugly having it there but it may break Remote Desktop in some way, not sure. Hoping the next OS update might fix the issue and not put files in /usr/local any more.

  • Welcome to Ask Different. Please refrain from adding comments in the Answer section. This is for answers to the questions only. If you have a different question, you can ask it by clicking Ask Question. You can also add a bounty to draw more attention to this question once you have enough reputation. See How to Ask for more info on how to ask a question. - From Review – fsb Jun 5 '17 at 0:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .