This guy noticed something I picked up on when 10.4 server came out. If you go into Server Admin and disable port 626, OS X Server automatically re-enables it. This port is used by serialnumberd, which relies on Bonjour to look for duplicate serial numbers of OS X Server on the local network.
The bug is that Server Admin doesn’t say anything about it. It still shows that it is disabled, and doing a port scan confirms it is open. The active rules show 626 open and the nice log entry in the Console helps too. It is bothersome that this process has the capability to change the firewall rules despite what the human admin did. It is things like this that add wood to the anti-mac fire in the enterprise market.
I guess my problem with this thing is that it’s no surprise. Apple and many other companies have used Bonjour to do serial number checks on the LAN. OS X Server is serialized for a good reason or else Apple wouldn’t put the effort into creating mechanisms such as this. It should be fixed in Server Admin and frankly probably shouldn’t be there at all. This little process should act more like dashboardadvisoryd in the sense that it should do a periodic check rather than offering a continually open port. The man page isn’t much help either.