What is `intu-ec-client` listening on TCP port 8021?

Solution 1:

So a colleague pointed me to a resource that kind of helps explaining the issue.

https://web.archive.org/web/20201014190758/https://lists.freeswitch.org/pipermail/freeswitch-users/2013-October/100619.html (kudos to @vikasgarg86 for finding and sending me that link).

Turns out there is this native launchd service com.apple.ftp-proxy.plist living at /System/Library/LaunchDaemons/com.apple.ftp-proxy.plist that fires /usr/libexec/ftp-proxy (https://github.com/drduh/macOS-Security-and-Privacy-Guide/blob/master/launchd/15B42_launchd.csv#L94) which apparently binds to TCP port 8021.

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>Disabled</key>
        <true/>
        <key>Label</key>
        <string>com.apple.ftp-proxy</string>
        <key>UserName</key>
        <string>_ftp</string>
        <key>Program</key>
        <string>/usr/libexec/ftp-proxy</string>
        <key>ProgramArguments</key>
        <array>
                <string>ftp-proxy</string>
                <string>-p</string>
                <string>-n</string>
                <string>-V</string>
                <string>-D3</string>
                <string>-t1800</string>
        </array>
        <key>inetdCompatibility</key>
        <dict>
                <key>Wait</key>
                <false/>
        </dict>
        <key>Sockets</key>
        <dict>
                <key>Listeners</key>
                <dict>
                        <key>SockNodeName</key>
                        <string>localhost</string>
                        <key>SockServiceName</key>
                        <string>8021</string>
                        <key>SockType</key>
                        <string>stream</string>
                </dict>
        </dict>
</dict>
</plist>

However that's only half the way into actually understanding what is going on. What the original author of the conversation linked here couldn't figure and myself too, is how that service got there in the first place. Why is it even running? and what are the consequences of changing the port from 8021 to something else.

Please comment bellow if you know the answers.

By the way sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.ftp-proxy.plist does the job of stopping the service.