OS: macOS 10.13.5 High Sierra; HW: Mid-2010 MacBookPro7,1 13” 2.66GHz Core 2 Duo
I am interested in blocking incoming connections to Apple’s two persistent daemons with internet-facing open ports—specifically apsd and rapportd (pid 276 & 317 respectively below):
$ netstat -avp tcp
Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address Foreign Address (state) rhiwat shiwat pid epid
tcp4 0 0 192.168.0.2.49271 17.252.28.71.5223 ESTABLISHED 131072 131072 276 0
tcp4 0 0 localhost.ipp *.* LISTEN 131072 131072 470 0
tcp6 0 0 localhost.ipp *.* LISTEN 131072 131072 470 0
tcp6 0 0 *.49157 *.* LISTEN 131072 131072 317 0
tcp4 0 0 *.49157 *.* LISTEN 131072 131072 317 0
Using the Application Layer Firewall control daemon (socketfilterfw), I have added and then instructed the firewall to block incoming connections to both daemons as indicated here:
$ socketfilterfw --listapps
ALF: total number of apps = 2
1 : /usr/libexec/rapportd
( Block incoming connections )
2 : /System/Library/PrivateFrameworks/ApplePushService.framework/apsd
( Block incoming connections )
The machine was then rebooted.
However, using Activity Monitor—>Network, it indicates that apsd is still receiving packets and as netstat above displays, it maintains an ESTABLISHED connection state. I am not proficient enough to verify blocking of rapportd, as it is perpetually in LISTEN state and never seems to receive data, but since its active buddy doesn’t appear blocked, I doubt that it is as well.
I know there are other routes to disabling these services (launchd/lingon, pf/murus, afw/vallum), but would prefer to resolve it through ALF/socketfilterfw if possible, if for no other reason than I would like to understand exactly why it doesn’t seem to work as advertised.
Than you all for your guidance in resolving this conundrum.
Bonus ’tard question: How do I log out of this site? The place is like Hotel California—I can’t seem to find the logout link, LOL!
