Services, sharing and open ports

Every sharing service you leave on is a small network server running on your Mac, waiting for someone to connect to it. Most people turn one on once, for one task, and never turn it off. This lesson covers finding and closing those, then adding a firewall on top as a second layer.

Sharing services

On current macOS, sharing services live in System Settings → General → Sharing: File Sharing, Screen Sharing, Remote Login (SSH), Remote Management, Media Sharing, Content Caching, Internet Sharing, Printer Sharing, and a few others depending on the Mac. Each one is off by default and stays off until you turn it on for a specific reason, such as sending a file to another Mac on the same network or letting a helper connect remotely.

• If you turned on File Sharing once to move files between two Macs, or Screen Sharing to get help from someone, turn it back off from the same Sharing pane once you are done.
• Remote Login opens SSH access to your Mac. Apple’s own documentation for it says plainly that “allowing remote login to your Mac can make it less secure.” Leave it off unless you specifically need to connect to this Mac from elsewhere.
• If several of these show as on and you do not remember turning them on, that alone is worth investigating.

Seeing what is actually listening

Turning sharing services off in System Settings closes the ones Apple exposes a switch for, but other software (a media server, a development tool, a printer driver) can open its own listening ports without asking. lsof (list open files, which on Unix includes network sockets) can show you every process currently waiting for an incoming TCP connection:

$ lsof -iTCP -sTCP:LISTEN -n -P
COMMAND     PID   USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
rapportd   1442 admin   15u  IPv4  ...       0t0  TCP *:64654 (LISTEN)
ControlCe  1775 admin    9u  IPv4  ...       0t0  TCP *:7000 (LISTEN)

Each line is one process listening on one port: the command name, its process ID, the address it is bound to (* means every network interface, 127.0.0.1 means local connections only), and the port number after the colon. -n and -P tell lsof to show raw addresses and port numbers instead of resolving them, which is both faster and clearer. A port bound only to 127.0.0.1 is reachable only from the Mac itself; a port bound to * can, network permitting, be reached from other devices. Some entries will be Apple’s own background services (like the AirDrop/Handoff helper rapportd, or Control Center’s AirPlay receiver); the ones worth questioning are apps you installed that you did not expect to be listening at all.

The Application Firewall

The Application Firewall, in System Settings → Network → Firewall, is a second layer on top of closing unused services: rather than blocking by port number, it decides per app whether that app may accept incoming connections at all. Apple describes it as protecting the Mac “from unwanted contact initiated by other computers when you’re connected to the internet or a network,” while still letting you allow specific apps or services through.

You can check the firewall’s current state from Terminal without changing anything:

$ /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
Firewall is enabled. (State = 1)
$ /usr/libexec/ApplicationFirewall/socketfilterfw --getstealthmode
Firewall stealth mode is off

Turning the firewall on and enabling stealth mode both require an administrator password; the read-only --get commands above do not change anything.