SSH won't work until the local account is logged in

Question

I've a Mac mini running Big Sur Monterey to which I cannot connect via ssh unless the user has his session started.

I guess this is, like on ubuntu, due to the authorized_keys file not been accessible until the session is started, but I don't seem to be able to apply a similar approach, and it is becoming an issue.

The Mac is being used as a server, and if for some reason the session is closed or the machine has to be restarted, I'm forced to connect a monitor, mouse and keyboard to start the session. The problem here is that this has already happened while working remotely, so I completely lost the access to the machine.

Is there a way to fix this?

This is the ssh output when the local account is not logged in

myhost:~ myusername$ ssh -vvv remoteuser@remoteIP
OpenSSH_8.6p1, LibreSSL 3.3.6
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 21: include /etc/ssh/ssh_config.d/* matched no files
debug1: /etc/ssh/ssh_config line 54: Applying options for *
debug1: /etc/ssh/ssh_config line 58: Applying options for *
debug2: resolve_canonicalize: hostname remoteIP is address
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts' -> '/Users/myusername/.ssh/known_hosts'
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts2' -> '/Users/myusername/.ssh/known_hosts2'
debug1: Authenticator provider $SSH_SK_PROVIDER did not resolve; disabling
debug3: ssh_connect_direct: entering
debug1: Connecting to remoteIP [remoteIP] port 22.
debug3: set_sock_tos: set socket 3 IP_TOS 0x48

Stays there until the connection is drop by timeout. If I start the remoteuser session locally, then after the last line we can see above, it adds the following line, and the ssh process continues.

debug1: Connection established.

Answer 1

As the details have changed, I’m leaving this up but OP doesn’t have FileVault. It may help others, however to have this item to check.

---

This is a common situation when people don't realize that FileVault, when enabled brings up a "pre-boot" screen that makes people think the OS is running and the storage is not encrypted.

Once you log in (which unlocks the storage where the OS and user data is stored, boots the mac and then completes the user log-in), open a command line and check your FileVault status:

/usr/bin/fdesetup status

If FileVault is Off then you have a legitimate problem with sshd being in a non-standard state. If FileVault is On - then you need to set a one time credential as part of the restart to have the OS start to a proper log in screen with all background daemons running and the expectation of ssh working remotely after that one restart.

/usr/bin/fdesetup authrestart