1

I want to be able to SSH in to my mac.

I do not want to be able to use passwords to authenticate.

I know how to configure this, what to put in /etc/ssh/sshd_config. But every time I install even a minor OS version upgrade, I have to go make these changes again, and its failure mode is "fail dangerous" - it simply starts allowing password authentication again.

Is there some other way to tell the OS not to re-enable password authentication on every update?

  • Why “fail dangerous”? Surely requiring the password is the “safer” option... and “permanently” may be a better choice compared to “persistently”. – Solar Mike Jul 24 '18 at 7:19
  • @SolarMike No, password is the least safe option. Requiring keys is the safe option here. – jksoegaard Jul 24 '18 at 8:55
  • I can't test at the moment, but you may be able to specify a different (custom) config file with the -f flag. In /System/Library/LaunchDaemons/ssh.plist add in the '-f /path/to/custom_sshd_config. This way, when an update is applied, it can't overwrite your settings reverting you back to password authentication. See man sshd_config for more. – Allan Jul 25 '18 at 18:37
  • @Allan Isn‘t /System/* protected by SIP? And even if it isn‘t: wouldn’t an update overwrite the plist as well? – nohillside Jul 25 '18 at 19:24
  • @nohillside - True. There's also the possibility of disabling the system provided sshd and then creating a custom .plist (in /Library/LaunchDaemons) that will start sshd with the custom options. An update shouldn't over write it if done that way. – Allan Jul 25 '18 at 20:05
1

Put this line into the /etc/rc.conf (I assume we're talking about FreeBSD).

sshd_flags="-oPasswordAuthentication=no"
  • 2
    There is no /etc/rc.conf on macOS. – nohillside Jul 25 '18 at 18:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .