OS 10.6.8: Something a bit puzzling in the System Preferences/Security/Firewall/Advanced

[RobJos]

As can be seen on this screenshot, AppleFileServer shows up three times, one Allowed and two Blocked:

I haven't been around these preferences for years, cannot even remember what this AppleFileServer is all about and somehow the net is not helpful. Nor do I know whether it is or they are best allowed or blocked, or of course, at this point, whether it's good or bad to have three of them. The system is otherwise running fine. Any idea?

 

[appltech]

Mine will be to block the first one and see what would crash/bark. Thinking that those are responsible for different protocols that are hidden under AppleFileServer

 

[chown33]

Contextual-click (right-click) on each one, and choose "Show in Finder".
Where does each one reside? Please post the patname.

 

[RobJos]

Thanks to both of you. As it turns out each one of them points exactly to the same path:

/System/Library/CoreServices/AppleFileServer.app/Contents/MacOS

@appltech: I'd rather wait until there is no other solution in sight before risking something drastic. Anyway, now that we know that it's the same file and path, I should think that it's mostly a question of whether it should be allowed or blocked.

But do you all happen to know what it's good for? FYI, if there's any relation, we have 3 machines running on our (very security-conscious) home network.

It's a long time ago, but I'm pretty sure that I would have noticed it the last time I was on that panel. A possibility that comes to my mind: a few months ago I had to use SuperDuper twice, when the machine was sent to repair and when it came back. SuperDuper, I found, is near perfect, best solution for this kind of stuff, but the end result can present some minor glitches. Could this AppleFileServer have been duplicated twice?

 

[chown33]

My guess is that this is related to File Sharing. It's configured in:
System Preferences > Sharing > File Sharing

I haven't had file-sharing enabled on my Snow Leopard machine in ages, though I do see it still has the configuration I was using from last time.

I just turned on File Sharing, and I don't see AppleFileServer appear in the Security pane, so maybe my guess is wrong. I probably can't look into this in any detail for at least a few days, but when I get a chance, I can poke around and see if blocking connections to AppleFileServer prevents file-sharing from working.

Or you could try it on the AppleFileServer that's currently enabled and see what happens. If something stops working, re-enable it. It should be reversible.

I do see a few UDP utilities I made listed in my firewall config. They work, and when I tell the firewall to block their ports, they can't listen any more, so the firewall is working. Enabling them in the firewall pane makes them work again.


On a different machine that was running Mountain Lion with MacOS X Server installed, I do recall disabling a few Server things in the Security pane, as a way to test some stuff I was working on at the time. I've long since deleted that config, so I can't tell you what was listed there.

 

[RobJos]

Thank you, chown33. File Sharing is enabled on all our machines, and it is in constant use. I just went and had a look: on machine #2 running High Sierra, the entry simply doesn't exist (at least under Firewall), whereas on machine #3, also running Snow Leopard, it is there, only once and allowed.

I'll try as you suggest, when it doesn't risk interfering with other operations. It may not be right away, but I'll be back to post how it went.

 

[chrfr]

The process AppleFileServer is what ran AFP file sharing back then.
applefileserver(1) [osx man page] (unix.com)

 

[RobJos]

Well, it looks like everything's now under control, thanks to all your tips and explanations. First thing, I removed the two “blocked”, and waited a day or so. Nothing had changed, so I tried blocking the remaining one that was “allowed”, and sure enough, the other machines on the house network couldn't connect to this one anymore. Re-allowing it brought things back to normal. Note that, either way, it took a reboot to enact the changes.

This still doesn't explain why I got those three entries. My only guess at this point, open to discussion, is the use of SuperDuper backups I've mentioned above.

Once again, thanks to everybody.