12

I want to be able to SSH in to my mac.

I do not want to be able to use passwords to authenticate.

I know how to configure this, what to put in /etc/ssh/sshd_config. But every time I install even a minor OS version upgrade, I have to go make these changes again, and its failure mode is "fail dangerous" - it simply starts allowing password authentication again.

Is there some other way to tell the OS not to re-enable password authentication on every update?

5
  • Why “fail dangerous”? Surely requiring the password is the “safer” option... and “permanently” may be a better choice compared to “persistently”.
    – Solar Mike
    Commented Jul 24, 2018 at 7:19
  • 3
    @SolarMike No, password is the least safe option. Requiring keys is the safe option here.
    – jksoegaard
    Commented Jul 24, 2018 at 8:55
  • 1
    I can't test at the moment, but you may be able to specify a different (custom) config file with the -f flag. In /System/Library/LaunchDaemons/ssh.plist add in the '-f /path/to/custom_sshd_config. This way, when an update is applied, it can't overwrite your settings reverting you back to password authentication. See man sshd_config for more.
    – Allan
    Commented Jul 25, 2018 at 18:37
  • 1
    @Allan Isn‘t /System/* protected by SIP? And even if it isn‘t: wouldn’t an update overwrite the plist as well?
    – nohillside
    Commented Jul 25, 2018 at 19:24
  • 2
    @nohillside - True. There's also the possibility of disabling the system provided sshd and then creating a custom .plist (in /Library/LaunchDaemons) that will start sshd with the custom options. An update shouldn't over write it if done that way.
    – Allan
    Commented Jul 25, 2018 at 20:05

1 Answer 1

12

I think starting with macOS Monterey (12.x) you can add your changes for sshd_config to a file in /etc/ssh/sshd_config.d/*.conf.

I could not find documentation for this on macOS, but for example, on Ubuntu 20.04 the sshd_config manpage explains how this works.

6
  • Awesome, thank you! The "documentation", such as it is, is in a big comment above the line Include /etc/ssh/sshd_config.d/* in /etc/ssh/sshd_config . I'll set up my sshd configuration on a Monterey machine and see if it gets blown away when the next update comes out...
    – Glyph
    Commented Nov 19, 2021 at 11:16
  • Were your sshd configuration changes preserved between updates using this approach?
    – Bob
    Commented Jan 15, 2022 at 2:39
  • 2
    @Bob Bah, sorry, I forgot to set this up so I'm not sure. I just wrote a file in that directory with ChallengeResponseAuthentication no and PasswordAuthentication no and it has taken effect, but I'll let you know after the next system update.
    – Glyph
    Commented Feb 17, 2022 at 23:45
  • 1
    At long last. Update from 21D62 to 21E230 applied. And yes… it worked! Passwords still aren't accepted, only public keys! Answer now accepted. Thank you @rjs!
    – Glyph
    Commented Mar 14, 2022 at 23:41
  • 1
    Several updates later (12.4, 21F79) this is still working. Hooray!
    – Glyph
    Commented Jun 29, 2022 at 20:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .