Find Files Responsible for Starting Process on Mac

If the process keeps reappearing then most likely it is started by launchd. Use launchctl to list jobs loaded to launchd:

sudo launchctl list
launchctl list

Job definitions for launchd in .plist files are stored in:

~/Library/LaunchAgents         Per-user agents provided by the user.
/Library/LaunchAgents          Per-user agents provided by the administrator.
/Library/LaunchDaemons         System-wide daemons provided by the administrator.
/System/Library/LaunchAgents   Per-user agents provided by Mac OS X.
/System/Library/LaunchDaemons  System-wide daemons provided by Mac OS X.

You might also grep the above files for actual path to executable.

For all processes you can check the output of ps -ef | grep <process_name> and check the parent process PPID.

  UID   PID  PPID   C STIME   TTY           TIME CMD
  501 17151  7357   0  9:35AM ttys000    0:00.00 grep grep

In this example grep process was spawned from process 7357. Later you can check ps -ef | grep 7357 to find out it was bash process that started grep.

Apple uses ports 106 and 3659 for its password service (a SASL-based remote authentication service), which is part of its Open Directory domain service. Shutting down the password service will break large parts of the Open Directory domain service (including local authentication to domain accounts).

If you want Open Directory to work, do not shut this down. On the other hand, if you don't want the Open Directory domain, then turn OD itself off (including the LDAP service and its section of Kerberos). On the gripping hand, if you want to use OD but don't want to unnecessarily expose services, then set up firewall rules to limit access to ports 106 and 3659 (and maybe 88, 389, 636, and 749).