Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

When I try to SSH to my computer, ssh fails with this error:

Mothership:~ kuyan$ ssh kuyan@localhost
Connection closed by ::1

This also happens when I attempt to SSH to my user from another computer. This message appears in Console when I attempt to connect:

12/12/12 3:44:30.468 PM sshd[2576]: fatal: ssh_sandbox_child: sandbox_init: dlopen(/usr/lib/libsandbox.1.dylib, 261): image not found [preauth]

Relevant information:

  • I'm using a different version of sshd than OS X provides, installed via brew install openssh - but this error occurs with both versions.
  • /usr/lib/libsandbox.1.dylib exists:

    Mothership:~ kuyan$ ls /usr/lib/libsandbox*
    /usr/lib/libsandbox.1.dylib /usr/lib/libsandbox.dylib
    
  • Here's my /etc/sshd_config. The relevant line seems to be UsePrivilegeSeparation: when uncommented and set to yes instead of sandbox, everything works A-OK.

  • Though I'm not using MacPorts, the error I'm getting is essentially the one here.
  • sshd version: OpenSSH_6.1p1, OpenSSL 0.9.8r 8 Feb 2011
share|improve this question

2 Answers 2

dtruss shows:

2892/0xdc8e:  stat64("/usr/lib/libsandbox.1.dylib\0", 0x7FFF500DA5F0, 0x7FFF500DB500)        = -1 Err#2

which is ENOENT (No such file or directory) and the reason is probably that chroot already happened. If you are so foolish as to experiment by

sudo mkdir -p /var/empty/usr/lib
sudo cp /usr/lib/libsandbox.1.dylib /var/empty/usr/lib

You will move the crash to the next shlib not under /var/empty/

sshd[3256]: fatal: ssh_sandbox_child: sandbox_init: dlopen (/usr/lib/libsandbox.1.dylib, 261):
Library not loaded: /usr/lib/libsqlite3.dylib\\n  Referenced from: /usr/lib/libsandbox.1.dylib\\n  Reason: image not found [preauth]

If you persist with this madness

sudo cp /usr/lib/libsqlite3.dylib /usr/lib/libMatch.1.dylib /var/empty/usr/lib/

sshd will start to work again at least for SSH keys, passwords still don't work.

You can also edit /usr/local/etc/sshd_config changing

UsePrivilegeSeparation sandbox

into

UsePrivilegeSeparation yes

But outside of debugging purposes I don't suggest trying any of this.

share|improve this answer
1  
Can you say more about why 'UsePrivilegeSeparation yes' is insufficient? Because right now that's the only option (AFAICT) if you want to use a non-standard sshd. –  TJ Luoma May 2 '13 at 23:06

I've fixed this problem in MacPorts' sshd by porting a patch from Apple's sshd (which can be found at http://opensource.apple.com/source/OpenSSH/OpenSSH-186/). Apple moved the function that calls sandbox_init(3) (which calls dlopen(3) internally) before the chroot(2) call that would make loading the library fail.

The required patches are

and openssh needs to be built with -D__APPLE_SANDBOX_NAMED_EXTERNAL__ in the preprocessor flags.

The failure to authenticate with passwords is because OS X doesn't support the required library functions to do that without using PAM. Setting UsePAM yes in your sshd_config should work (as should applying http://trac.macports.org/browser/trunk/dports/net/openssh/files/pam.patch, which changes the default to enabling PAM).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.