Firewall settings Question on blocking

Question

powerbook1701 Author

Level 3

670 points

Firewall settings Question on blocking

I have these set to block incoming connections, but was hoping someone would offer advice if I should:

com.apple.webkit.networking.xpc

netbiosd

ntpd

MacBook Air, macOS High Sierra (10.13.6), (2017 version)

Posted on Nov 7, 2018 3:29 PM

Reply

Answer 1

BDAqua

Level 10

250,253 points

Nov 8, 2018 7:04 AM in response to powerbook1701

The ntpd program is an operating system daemon which sets and maintains the system time of day in synchronism with Internet standard time servers... So I wouldn't.

netbiosd is responsible for interacting with NetBIOS networks. NetBIOS is Microsoft's networking service... So I guess it could be
OK to block.

If you block incoming netbiosd connections then you will not be able to share drives over netbios which is the simplest way to share data to Windows machines.

If you generally block incoming connections as a precaution the you should block anything until you actually need it, that is until something breaks. So yes block netbiosd to begin with.

com.apple.webkit.networking.xpc could be dangerous...

com.apple.WebKit.Networking.xpc want to sign using key "Apple ID Authentication (date, time) in your keychain

Reply

Answer 2

powerbook1701 Author

Level 3

670 points

Nov 8, 2018 10:32 AM in response to BDAqua

as far as com.app.webkit.networking.xpc, I didn't get that long dreaded message about keychain etc. When I powered on for the first time, I got a message saying do I want to accept connections, so I said NO as I remember something bad. That said, I assume that was not bad to start with, but could have eventually let to issues?

I use my Mac via hotspot and home on my secured network, so I guess I am behind a firewall at home.

Reply

Answer 3

powerbook1701 Author

Level 3

670 points

Nov 8, 2018 12:57 PM in response to BDAqua

Confused. Sorry, long day at work. You said could have opened up myself to issues, but since I said no, I’m good. But you are saying I should not block the basic one as it’s ok?

Thanks and sorry, just wanted to be clear

Reply

Answer 4

BDAqua

Level 10

250,253 points

Nov 8, 2018 1:09 PM in response to powerbook1701

That's OK, com.app.webkit.networking.xpc being not blocked should be extra protection, without it it's like you have 2 choices... NO don't open the door at all, or YES, open the door without knowing who it is, with it running/enabled it's like... what's the secret word before I open the door.

Reply

Answer 5

powerbook1701 Author

Level 3

670 points

Nov 8, 2018 2:35 PM in response to BDAqua

Ok, just noticed something. I have TWO different machines. One, just new out of the box.

Since I have "automatically allow system software..." then the com.apple.webkit.networking.xpc" is set GREEN on one and RED on the other machine. I think it's RED on one because I only recently turned on"automatically allow system software..."

In recap, leaving it GREEN and accepting incoming is OK. Or, just delete it and wait for something to trigger it to ask me.

Reply

Answer 6

Nov 9, 2018 11:40 AM in response to powerbook1701

Just turn it on and leave it unless your corporate staff tells you to turn it off.

The truth about firewalls is they are only usefully if your software is BROKEN. (ie, if you have a broken web browser, if you have a stupid routing daemon that creates routes that shouldn't be allow, whatever). ports that don't have software answering always hang up. software than answers a call and performs bad actions from computers you didn't intend to talk to: is at fault.

Some software requires "full access" to the network connection for full features and requires middle men (firewall) to be off, you'd be told by your company to turn it off. But likely you don't have any.

The default setting should be ok. turning it on is ok.

Reply