17

I want to disable password auth - ie keys only - on SSH. I've done this many times on Linux variants, and some searching here suggests it's the same on Mac, ie:

/etc/ssh/sshd_config

Then add/edit:

PasswordAuthentication no

However, this seems to have no effect - ie I can still log in with a password. Is there any different trick to do this on High Sierra?

Improve this question
3
  • 1
    You have to edit the ssh.plist. This will require disabling SIP. Editing it, reloading it via launchctl, then reenabling SIP.
    – Allan
    Commented Feb 19, 2018 at 18:18
  • 2
    Especially UsePAM has to be set to no. The settings of the following 4yo sshd_config should still work in 10.13: SSH config that is password less
    – klanomath
    Commented Feb 19, 2018 at 18:33
  • 1
    @Allan I can confirm that you don't. I successfully disabled password auth in High Sierra (10.13.5) by editing only /etc/ssh/sshd_config (I set the PermitRootLogin, PasswordAuthentication, ChallengeResponseAuthentication, and UsePAM options all to no); SIP has never been disabled on this particular Mac.
    – Calrion
    Commented Jul 1, 2018 at 0:52

4 Answers 4

Reset to default
18

To prevent authentication without a public key, search for each of these in /etc/ssh/sshd_config, uncomment them, and set them to 'no':

PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM no

To restart sshd (which is required to have it reread the config file), use

sudo launchctl stop com.openssh.sshd
sudo launchctl start com.openssh.sshd

PS: Please be aware that macOS tends to overwrite /etc/ssh/sshd_config with each minor update. Starting with Monterey you can put your definitions in /etc/ssh/sshd_config.d/000-local.conf to avoid this.

Improve this answer
5
  • 2
    Works also on Big Sur 11.6 Thanks.
    – Pavol Travnik
    Commented Sep 16, 2021 at 8:21
  • My original answer only required setting PasswordAuthentication and UsePAM to no. Is it really necessary to also set ChallengeResponseAuthentication to no? What changed?
    – kas
    Commented Nov 6, 2021 at 3:19
  • 1
    @coolaj86 What does ChallengeResponseAuthentication add?
    – nohillside ♦
    Commented Nov 6, 2021 at 18:01
  • 1
    @nohillside For macOS specifically, quite possibly nothing, but for ssh in general ChallengeResponseAuthentication refers to password authentication - so if you disable PAM but don't disable the other then it's still possible to login via password.
    – coolaj86
    Commented Nov 7, 2021 at 18:21
  • Putting it into /etc/ssh/sshd_config.d/000-local.conf on Monterey is an excellent idea. By my testing, config files with lower numbers override options set in files with higher numbers, so 000 (as opposed to 999) is indeed the best choice of number for this file.
    – Jo Liss
    Commented Nov 8, 2021 at 16:18
5

As it was said in klanomath's comment disabling only these lines won't work.

PermitRootLogin no
PasswordAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication no

To disable password login you need to edit UsePAM line as well.

UsePAM no
Improve this answer
3

klanomath's comment

Especially UsePAM has to be set to no. The settings of the following 4yo sshd_config should still work in 10.13: SSH config that is password less – klanomath 2 hours ago

Seems to work. Never had to do that on Linux systems. Many thanks!

Improve this answer
1

For anyone still struggling with this on Mac Sonoma, here's what's missing from the other answers: You need to modify the following file: /etc/ssh/sshd_config.d/100-macos.conf

Here's the full file:

# Options set by macOS that differ from the OpenSSH defaults.
UsePAM no
PasswordAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication no
AcceptEnv LANG LC_*
Subsystem       sftp    /usr/libexec/sftp-server
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .