9

I want to disable password auth - ie keys only - on SSH. I've done this many times on Linux variants, and some searching here suggests it's the same on Mac, ie:

/etc/ssh/sshd_config

Then add/edit:

PasswordAuthentication no

However, this seems to have no effect - ie I can still log in with a password. Is there any different trick to do this on High Sierra?

  • 1
    You have to edit the ssh.plist. This will require disabling SIP. Editing it, reloading it via launchctl, then reenabling SIP. – Allan Feb 19 '18 at 18:18
  • 2
    Especially UsePAM has to be set to no. The settings of the following 4yo sshd_config should still work in 10.13: SSH config that is password less – klanomath Feb 19 '18 at 18:33
  • @Allan I can confirm that you don't. I successfully disabled password auth in High Sierra (10.13.5) by editing only /etc/ssh/sshd_config (I set the PermitRootLogin, PasswordAuthentication, ChallengeResponseAuthentication, and UsePAM options all to no); SIP has never been disabled on this particular Mac. – Calrion Jul 1 '18 at 0:52
6

For High Sierra, to prevent authentication without publickey, in the /etc/ssh/sshd_config file, set

PasswordAuthentication no
UsePAM no

To restart sshd (which is required to have it reread the config file), use

sudo launchctl stop com.openssh.sshd
sudo launchctl start com.openssh.sshd
3

klanomath's comment

Especially UsePAM has to be set to no. The settings of the following 4yo sshd_config should still work in 10.13: SSH config that is password less – klanomath 2 hours ago

Seems to work. Never had to do that on Linux systems. Many thanks!

1

As it was said in klanomath's comment disabling only these lines won't work.

PermitRootLogin no
PasswordAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication no

To disable password login you need to edit UsePAM line as well.

UsePAM no

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .