I'm trying to set up some (rudimentary) ssh security on my workstation behind a router on a home network. It's running Mac OS X Lion (10.7).
As I understand it, what one would normally do under such circumstances is change the appropriate parts of an /etc/sshd_config
file. For example, I might have
# akil@computerA:/etc/sshd_config
Port 12345
Protocol 2
PermitRootLogin no
PasswordAuthentication no
And this would, respectively only listen on port 12345, accept authentication method "2" only, disallow root logins, and only allow key logins. I would then restart the ssh daemon and then everything would be great.
Apparently this worked Snow Leopard (OS X 10.6), but it does not seem to work for Lion. Lion seems to ignore anything in the sshd_config
file.
For changing the port, you can follow the advice of some blogs and forums posts (1,2) that direct you to change (a) add a new ssh service by editing /System/Library/LaunchDaemons/ssh.plist
and (b) defining the port of the new service in /etc/services
.
This works -- doing ssh akil@computerA.local
refuses the connection, but now ssh akil@computerA.local -p 12345
works fine.
The problem is that I have no idea how to use similar steps to change anything else: how do I disable root logins and/or password authentications?