Rabbitmq-server: Firewall prompt on OSX: Do you want the application “beam.smp” to accept incoming network connections?

[sluramod]

For Those Landing Here from Google, Baidu, etc

See this doc section on how to white list RabbitMQ node processes
with the macOS firewall.

Original Issue

I keep getting the following prompt:

Do you want the application “beam.smp” to accept incoming network connections?

Regardless of which option I choose (Accept or Deny), I will keep getting the same prompt every few minutes.

• RabbitMQ version
  3.7.10
• Erlang version
  21.2.4
• RabbitMQ plugin information via rabbitmq-plugins list
  [E] rabbitmq_amqp1_0 3.7.10
  [E] rabbitmq_management 3.7.10
  [e] rabbitmq_management_agent 3.7.10
  [E] rabbitmq_mqtt 3.7.10
  [E] rabbitmq_stomp 3.7.10
  [e] rabbitmq_web_dispatch 3.7.10
• Client library version (for all libraries used)
• Operating system, version, and patch level
  MacOS Mojave 10.14.2
• Configuration
  Default using homebrew

[michaelklishin]

Thank you for your time.

Team RabbitMQ uses GitHub issues for specific actionable items engineers can work on. GitHub issues are not used for questions, investigations, root cause analysis, discussions of potential issues, etc (as defined by this team).

We get at least a dozen of questions through various venues every single day, often light on details.
At that rate GitHub issues can very quickly turn into a something impossible to navigate and make sense of even for our team. Because GitHub is a tool our team uses heavily nearly every day, the signal/noise ratio of issues is something we care about a lot.

Please post this to rabbitmq-users.

Thank you.

[michaelklishin]

Since Erlang doesn't have an application to add in the UI, an exception must be added using /usr/libexec/ApplicationFirewall/socketfilterfw --add /path/to/bin/erl.

[michaelklishin]

man socketfilterfw is scarce on details but looks like to whitelist an executable it has to be added then unblocked:

/usr/libexec/ApplicationFirewall/socketfilterfw --add /path/to/bin/erl
/usr/libexec/ApplicationFirewall/socketfilterfw --unblock /path/to/bin/erl

Some threads suggest that if a service binds to localhost only, its traffic is always allowed. See RabbitMQ Networking guide to find out how to do that.

[sluramod]

For those experiencing this problem: make sure you use path to erl executable, not symlink. In case of homebrew it will be in /usr/local/Cellar/erlang/<version>/lib/erlang/bin/erl otherwise you will get The application is not part of the firewall message at --unblock step:

• /usr/libexec/ApplicationFirewall/socketfilterfw --add /usr/local/Cellar/erlang/<version>/lib/erlang/bin/erl
• /usr/libexec/ApplicationFirewall/socketfilterfw --unblock /usr/local/Cellar/erlang/<version>/lib/erlang/bin/erl

[scuml]

Needed --unblockapp on my machine running OS 10.14 ...

/usr/libexec/ApplicationFirewall/socketfilterfw --add  /usr/local/Cellar/erlang/<version>/lib/erlang/bin/erl
/usr/libexec/ApplicationFirewall/socketfilterfw --unblockapp  /usr/local/Cellar/erlang/<version>/lib/erlang/bin/erl

[michaelklishin]

We will add this to the docs, although it looks like socketfilterfw remains scarcely documented and keeps changing the arguments it supports from macOS version to version.

[adimittal]

I was able to see the beam.smp as blocked in Security and Privacy => Firewall settings. Running the following command unblocked it for me.

$ /usr/libexec/ApplicationFirewall/socketfilterfw --unblock /usr/local/Cellar/erlang/21.2.4/lib/erlang/erts-10.2.3/bin/beam.smp

Incoming connection to the application is permitted

Update for newer version:
$ /usr/libexec/ApplicationFirewall/socketfilterfw --unblock /usr/local/Cellar/erlang/23.1.2/lib/erlang/erts-11.1.2/bin/beam.smp

[mousomer]

Thanks, @adimittal . That was helpful.

[michaelklishin]

I have added a new doc section to the Networking guide. Further clarifications are welcome in pull requests.