I want to be able to SSH in to my mac.

I do not want to be able to use passwords to authenticate.

I know how to configure this, what to put in /etc/ssh/sshd_config. But every time I install even a minor OS version upgrade, I have to go make these changes again, and its failure mode is "fail dangerous" - it simply starts allowing password authentication again.

Is there some other way to tell the OS not to re-enable password authentication on every update?

  • Why “fail dangerous”? Surely requiring the password is the “safer” option... and “permanently” may be a better choice compared to “persistently”. – Solar Mike Jul 24 '18 at 7:19
  • 1
    @SolarMike No, password is the least safe option. Requiring keys is the safe option here. – jksoegaard Jul 24 '18 at 8:55
  • 1
    I can't test at the moment, but you may be able to specify a different (custom) config file with the -f flag. In /System/Library/LaunchDaemons/ssh.plist add in the '-f /path/to/custom_sshd_config. This way, when an update is applied, it can't overwrite your settings reverting you back to password authentication. See man sshd_config for more. – Allan Jul 25 '18 at 18:37
  • 1
    @Allan Isn‘t /System/* protected by SIP? And even if it isn‘t: wouldn’t an update overwrite the plist as well? – nohillside Jul 25 '18 at 19:24
  • 2
    @nohillside - True. There's also the possibility of disabling the system provided sshd and then creating a custom .plist (in /Library/LaunchDaemons) that will start sshd with the custom options. An update shouldn't over write it if done that way. – Allan Jul 25 '18 at 20:05

You must log in to answer this question.

Browse other questions tagged .