So I want to harden my SSH daemon when Remote Login is enabled.

So far I've found:

  • /private/etc/ssh/sshd_config
  • /System/Library/LaunchDaemons/ssh.plist -> protected by SIP
  • /etc/ssh/sshd_config

Why are there 3 locations, and what is the difference?


If you look at the specific files you'll see that there are actually only two files (/etc/ssh/sshd_config and /private/etc/ssh/sshd_config is the same file unless your setup is non-standard).

  • /System/Library/LaunchDaemons/ssh.plist is used by the system to start sshd, usually you don't need to change this
  • /private/etc/ssh/sshd_config is the global configuration file for sshd, and the place where you need to change whatever is required to harden SSH on your Mac.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .