Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
75

To forward all port 80 traffic to port 8080, you can enter the following from the Terminal command line. echo " rdr pass inet proto tcp from any to any port 80 -> 127.0.0.1 port 8080 " | sudo pfctl -ef - Taken from https://salferrarello.com/mac-pfctl-port-forwarding/


60

While RedYeti's link is useful, just to save a few clicks for others let me recap how to generate a code-signing cert and to use it for code (re-)signing: Create your own code signing cert: In Keychain Access, Keychain Access > Certificate Assistant > Create a certificate. This launches the Certificate Assistant: Name: Enter some arbitrary string here ...


54

sudo codesign --force --deep --sign - /path/to/application.app I've never had to create a certificate using this method. If that doesn't help, try without --deep and without the trailing slash: sudo codesign --force --sign - /path/to/application.app Note, just to make it clearer: After having applied the signature, start the app, accept incoming ...


35

The modern way to forward ports in El Capitan is using pf. In the example below all port 80 requests are forwarded to port 8080 on the same host. Please adjust the redirections to your needs. Create an anchor file org.user.forwarding in /private/etc/pf.anchors sudo touch /private/etc/pf.anchors/org.user.forwarding with the following content and a ...


34

netbiosd is responsible for interacting with NetBIOS networks. NetBIOS is Microsoft's networking service. If you block incoming netbiosd connections then you will not be able to share drives over netbios which is the simplest way to share data to Windows machines. If you generally block incoming connections as a precaution the you should block anything ...


27

To disable password authentication you need to edit /etc/sshd_config. In Terminal: sudo vim /etc/sshd_config (or replace with your favourite editor) Look for the line: #ChallengeResponseAuthentication yes And change it to: ChallengeResponseAuthentication no That is, remove the # at the beginning, and change yes to no. All subsequent ssh logins will ...


22

From man sshd: /etc/hosts.allow /etc/hosts.deny Access controls that should be enforced by tcp-wrappers are defined here. Further details are described in hosts_access(5). http://www.debian-administration.org/articles/87 offers these examples: # /etc/hosts.allow sshd: 1.2.3.0/255.255.255.0 sshd: 192.168.0.0/255.255.255.0 # /etc/hosts.deny sshd: ALL ...


22

Xcode is likely trying to use the network. This is triggering a rule in your firewall that results in Xcode's code signature being checked – requiring a read of the complete application bundle. Experiment with the following option in OS X's firewall settings: System Preferences.app > Security & Privacy > Firewall > Firewall Options… > Automatically ...


21

I had the same issue under OS X Yosemite (10.10.3). Found this blog post that provides clear instructions. We can't use ipfw any more, as it's deprecated. Instead, use pfctl, which unfortunately lacks a nice command line way to tell it to open a port. Instead, you need to: Open /etc/pf.conf in a text editor. Add a line like this: # Open port 8080 ...


19

Little Snitch Research Assistant tells you what it is. akd is part of the AuthKit (authentication/authorisation) framework. Also used in the process of authenticating of iCloud and other accounts using Apple ID.


18

Little Snitch offers three features that aren't available in MacOS' built-in ipfw firewall. (It does this by loading a custom kernel module.) Little Snitch allows you to block outgoing connections; the MacOS firewall only blocks incoming connections. Handy if you're running some untrusted program and aren't sure what it's going to do, or if you want to ...


18

Basic differences The basic task of the MacOSX Firewall is to monitor incoming network connections. HandsOff and LittleSnitch also allow to monitor outgoing network connections. The latter functionality is essential for various reasons like spyware and privacy. Because LittleSnitch does not monitor incoming connections (unlike HandsOff!) it cannot replace ...


16

I can't speak for Office 2011 because it requires you to activate your serial number with Microsoft, but in Office 2008, Office 2004 and Offive v.X, the incoming network connection is part of Microsoft's anti-piracy efforts. Since each copy of Office is activated with a unique product key, Office products open an incoming network connection and listen for ...


14

This relates to whether the app is signed or not. If it's not signed, the preference won't be remembered. To see if an app is signed do this in Terminal: cd path/to/your/app codesign -vvv Eclipse.app/ For Eclipse - mine says it's not signed at all. I can't comment further on how to sign the app since I've not bothered to do that but this answer on ...


13

The most full featured way to peek into web traffic is to install and configure your system to use a web proxy. The mitmproxy proxy (and mitmdump tool) is mature, reliable and well documented so I would start there unless you have another that meets your specific needs. Also, widely and well regarded is https://www.charlesproxy.com


12

Page 27 of the September 2015 iOS Security White Paper states that there is not a firewall on iOS. On other platforms, firewall software is needed to protect open communication ports against intrusion. Because iOS achieves a reduced attack surface by limiting listening ports and removing unnecessary network utilities such as telnet, shells, or a web ...


12

What you are referring to as "the built-in" firewall is actually the built-in Application Firewall. There two other built-in firewalls in OS X Lion, pf and ipfw (the latter is being replaced by pf, but still exist in Mountain Lion). These can handle both incoming and outgoing connections and are typically controlled through command line scripts and ...


11

Worked for me. I wanted to open traffic on port 70, so I entered the following: sudo ipfw add 7000 allow tcp from any to any dst-port 70 The response from the command-prompt was: 07000 allow tcp from any to any dst-port 70 Yes, the 0 was automatically added to the rule #, so it is worth noting that any rule ID < 10,000 will be prefixed by one or more ...


11

You could use the PF firewall: Add this line to /etc/pf.conf to drop all packets to the given ip:port block drop out quick proto tcp to 192.168.1.103 port 80 After changing pf.conf you should reload it with sudo pfctl -f /etc/pf.conf Eventually you will have to enable it with sudo pfctl -e


10

Sounds like you need a packet sniffer. Wireshark will log and do full disassembly on all traffic going through your network interface. In other words, it will not just show you the full URLs of each request, but it will let you look inside all the packets, so you can see the headers and content too (except in SSL connections, as they are encrypted). It ...


10

Neither of those ports is opened by the OS. You will want to run a command like sudo lsof|grep LISTEN to figure out what processes have opened those ports on the Mac. See http://support.apple.com/kb/TS1629 for documented ports that Apple uses and note that neither are used other than 10.4 server and earlier where port 8080 was part of jboss as a stock ...


10

OS X Yosemite doesn’t have support for natd binary or ipfw anymore. Instead pfctl is used. I assume the following IP-adresses/netmasks: Router: 192.168.0.1/24 Mac mini gateway: en0: 192.168.0.2/24 gateway 192.168.0.1 en1: 192.168.1.2/24 Internal network: 192.168.1.0/24 First you have to enable forwarding on your Mac computer with following commands: sudo ...


10

To permanently block outgoing traffic to specific domains and/or ports you should create a new anchor file and add it to pf.conf. Create an anchor file org.user.block.out in /private/etc/pf.anchors sudo touch /private/etc/pf.anchors/org.user.block.out with the following content and a trailing empty line mybadtcphosts = "{ www.domain.com, domain.com, 135....


10

To permanently block outgoing traffic to specific domains you should create a new anchor file and add it to pf.conf. Create an anchor file org.user.block.out in /private/etc/pf.anchors sudo touch /private/etc/pf.anchors/org.user.block.out with the following content and a trailing empty line mybadhosts = "{ www.domain.com, domain.com, www.domain2.com, ...


9

Here is an improved walkthrough to install fail2ban on OS X 10.10 (it probably works on 10.9 also) based on the (somehow faulty) guide at forgetcomputers.zendisk.com. The automated installer didn't work at all for me so I did it manually. cd to ~/Downloads and download fail2ban-0.8.10 cd ~/Downloads curl -O https://forgetcomputers.zendesk.com/hc/en-us/...


8

For outgoing connections, the only jailbreak application that exists is Firewall iP. It behaves similarly to the Mac OS X application Little Snitch. For incoming connections, you will have to use a regular firewall system such as ipfw. Disclaimer: To anyone actually looking to use ipfw on iOS, you're going to have to patch the kernel to include support for ...


8

Yes, there are pre-built rule sets, and someone shares them. I just stumbled upon this: Little Snitch rules for blocking ad servers Here they provide a list of pre-built rules for blocking ad-servers. It is not related specifically to iCloud, but in general yes, there are shared sets of rules for Little Snitch. Edit: now I see what Dylan was referring ...


Only top voted, non community-wiki answers of a minimum length are eligible