7

I've a Mac mini running Big Sur Monterey to which I cannot connect via ssh unless the user has his session started.

I guess this is, like on ubuntu, due to the authorized_keys file not been accessible until the session is started, but I don't seem to be able to apply a similar approach, and it is becoming an issue.

The Mac is being used as a server, and if for some reason the session is closed or the machine has to be restarted, I'm forced to connect a monitor, mouse and keyboard to start the session. The problem here is that this has already happened while working remotely, so I completely lost the access to the machine.

Is there a way to fix this?

This is the ssh output when the local account is not logged in

myhost:~ myusername$ ssh -vvv remoteuser@remoteIP
OpenSSH_8.6p1, LibreSSL 3.3.6
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 21: include /etc/ssh/ssh_config.d/* matched no files
debug1: /etc/ssh/ssh_config line 54: Applying options for *
debug1: /etc/ssh/ssh_config line 58: Applying options for *
debug2: resolve_canonicalize: hostname remoteIP is address
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts' -> '/Users/myusername/.ssh/known_hosts'
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts2' -> '/Users/myusername/.ssh/known_hosts2'
debug1: Authenticator provider $SSH_SK_PROVIDER did not resolve; disabling
debug3: ssh_connect_direct: entering
debug1: Connecting to remoteIP [remoteIP] port 22.
debug3: set_sock_tos: set socket 3 IP_TOS 0x48

Stays there until the connection is drop by timeout. If I start the remoteuser session locally, then after the last line we can see above, it adds the following line, and the ssh process continues.

debug1: Connection established.
5
  • 2
    I don’t have to do any setup for my minis to have ssh bit I don’t change anything on these setups. We just ssh in with password. No keys, no dot file configs. Out of the box, you should expect ssh to work as soon as you enable remote log in in system preferences. Do you do any customization of ssh?
    – bmike
    Commented Jul 8, 2022 at 13:38
  • No. That's why I'm surprised. It was installed and updated via AppStore.
    – Indoctum
    Commented Jul 8, 2022 at 15:10
  • Or firewall? unix.stackexchange.com/q/675201/8888
    – bmike
    Commented Jul 8, 2022 at 16:08
  • No. Besides, I would expect the port to be closed even after the login if it were blocked by the firewall. Another thing I've discovered is that, if I lock the session, it won't reconnect until I close the current session and start a new one. Recovering the locked session doesn't work either. I think I'll call it a day. I see myself reinstalling the system in the near future...
    – Indoctum
    Commented Jul 8, 2022 at 18:00
  • This is really interesting - hopefully it’s not some bizarre secure token stuff - at some point blowing it away might save your sanity
    – bmike
    Commented Jul 8, 2022 at 19:42

1 Answer 1

7

As the details have changed, I’m leaving this up but OP doesn’t have FileVault. It may help others, however to have this item to check.


This is a common situation when people don't realize that FileVault, when enabled brings up a "pre-boot" screen that makes people think the OS is running and the storage is not encrypted.

Once you log in (which unlocks the storage where the OS and user data is stored, boots the mac and then completes the user log-in), open a command line and check your FileVault status:

/usr/bin/fdesetup status

If FileVault is Off then you have a legitimate problem with sshd being in a non-standard state. If FileVault is On - then you need to set a one time credential as part of the restart to have the OS start to a proper log in screen with all background daemons running and the expectation of ssh working remotely after that one restart.

/usr/bin/fdesetup authrestart
5
  • 1
    FileVault is off. It is actually running Monterey 12.2 and I can see there is an update to 12.4 available. so I'll give it a chance.
    – Indoctum
    Commented Jul 8, 2022 at 13:28
  • Good plan. What processor type is your mini? @Indoctum also, any MDM or directory to which you bind your Mac?
    – bmike
    Commented Jul 8, 2022 at 13:35
  • No joy after the update. @bmike, no, this is an stand alone device with local accounts, and it comes with an Apple M1 chip. The funny thing is that it is an standard installation/upgrade from the App Store I'll paste the ssh -vvv output on the original question, but honestly, it doesn't give me any hint. It seems to be the storage to be encrypted as you said. I don't know if, as a workaround, it'll be possible to create a cron job to start the accounts I need to access remotely, as I'm afraid it may not be executed either.
    – Indoctum
    Commented Jul 8, 2022 at 14:52
  • I'm trying to find something regarding the debug3: set_sock_tos: set socket 3 IP_TOS 0x48. I've seen several cases, but so far, I've not been able yet, to find a solution
    – Indoctum
    Commented Jul 8, 2022 at 15:07
  • Cron will absolutely not help, what you might try is setting up a basic (non admin) account and have it auto log in and have it screen lock after a minute
    – bmike
    Commented Jul 8, 2022 at 16:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .