2

I'm wondering how I can either kill it or change the port it listens on.

Neither lsof -nP -i4TCP:8021 | grep LISTEN nor netstat -av | grep 8021 or launchctl list | awk 'NR>1 {print $3}' | xargs -I % sh -c 'launchctl list "%"' > launchctl.log give me the process ID so I can kill it or get more info.

enter image description here

  • 2
    Google says port & name matches 'Intuit Entitlement Client' - so probably QuickBooks checking your license. – Tetsujin Oct 14 at 17:44
  • I'm having a hard time even locating the process id to manually kill it. – n370 Oct 14 at 17:52
  • Why are you trying to kill it? If an app cannot contact its licensing server it will eventually lock you out. This is starting to sound like an XY Problem – Tetsujin Oct 14 at 17:53
  • So, how did you find that particular process was listening on that particular port? – Allan Oct 14 at 18:10
  • I'm working on a web server project that is supposed to listen on that port but when I try to start it up it fails with "address already in use" error. I could change it to start on whatever port I want but I'm wondering why that port is being used. I'm no QuickBooks user afaik. lsof -nP -i4TCP:8021 | grep LISTEN gives nothing and netstat -av | grep 8021 also comes back empty. – n370 Oct 14 at 18:27
0

So a colleague pointed me to a resource that kind of helps explaining the issue.

https://web.archive.org/web/20201014190758/https://lists.freeswitch.org/pipermail/freeswitch-users/2013-October/100619.html (kudos to @vikasgarg86 for finding and sending me that link).

Turns out there is this native launchd service com.apple.ftp-proxy.plist living at /System/Library/LaunchDaemons/com.apple.ftp-proxy.plist that fires /usr/libexec/ftp-proxy (https://github.com/drduh/macOS-Security-and-Privacy-Guide/blob/master/launchd/15B42_launchd.csv#L94) which apparently binds to TCP port 8021.

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>Disabled</key>
        <true/>
        <key>Label</key>
        <string>com.apple.ftp-proxy</string>
        <key>UserName</key>
        <string>_ftp</string>
        <key>Program</key>
        <string>/usr/libexec/ftp-proxy</string>
        <key>ProgramArguments</key>
        <array>
                <string>ftp-proxy</string>
                <string>-p</string>
                <string>-n</string>
                <string>-V</string>
                <string>-D3</string>
                <string>-t1800</string>
        </array>
        <key>inetdCompatibility</key>
        <dict>
                <key>Wait</key>
                <false/>
        </dict>
        <key>Sockets</key>
        <dict>
                <key>Listeners</key>
                <dict>
                        <key>SockNodeName</key>
                        <string>localhost</string>
                        <key>SockServiceName</key>
                        <string>8021</string>
                        <key>SockType</key>
                        <string>stream</string>
                </dict>
        </dict>
</dict>
</plist>

However that's only half the way into actually understanding what is going on. What the original author of the conversation linked here couldn't figure and myself too, is how that service got there in the first place. Why is it even running? and what are the consequences of changing the port from 8021 to something else.

Please comment bellow if you know the answers.

By the way sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.ftp-proxy.plist does the job of stopping the service.

| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .