I have an older OS X 10.5 PowerMac (PowerPC) that needs to be online for testing software under the processor. It needs to be online because others want to use it for testing, too. I've updated OpenSSL and OpenSSH with new binaries placed in /usr/local. I also added a new Launchd plist at /System/LaunchDaemons to enable the new OpenSSH daemon on port 1522.

Now I want to permanently disable the existing Apple provided OpenSSH located at /usr/sbin/sshd. I don't want to delete it or replace it because that often causes more trouble than its worth. A search with http://www.google.com/search?q=apple+disable+sshd+site:apple.com appears to reveal no support documents on the subject. I found lots of discussions about updating OpenSSH and disabling it through the UI, but nothing about permanently disabling it.

I tried removing the execute bit, but that did not work. After reboot, Launchd still managed to start sshd. Other thoughts include a filesystem extended attribute to deny access to it.

How do I safely and permanently disable the existing OpenSSH daemon?


The most simple way to disable the Apple provided sshd without removing or replacing it is just renaming it:

sudo mv /usr/sbin/sshd /usr/sbin/sshd.old

Additionally you may add a symbolic link at /usr/sbin/ to the /usr/local/sbin/sshd with

sudo ln -s /usr/local/sbin/sshd /usr/sbin/sshd

You must log in to answer this question.