25

I have a Macbook Air that I would like to allow remote SSH access to without a password. I have created a user called remotepair that I have logged into and verified I can used the Mac with. I have also added this user to the "Remove Login" service's allowed user list and turned on the service. This was all done in the "Sharing" control panel.

I have gotten the public key of another computer and added it to the file /Users/remotepair/.ssh/authorized_keys. When the other computer does ssh remotepair@<my ip> I still get a password prompt.

How do I disable this password prompt?

Improve this question
1
  • 1
    I recommend adding "SSH Key-only authentication" to your question title--the way it reads now sounds like a regular GUI loginwindow login. – NReilingh Jul 31 '12 at 3:38
29

To disable password authentication you need to edit /etc/ssh/sshd_config. In Terminal:

sudo vim /etc/ssh/sshd_config

(or replace with your favourite editor)

Look for the line:

#ChallengeResponseAuthentication yes

And change it to:

ChallengeResponseAuthentication no

That is, remove the # at the beginning, and change yes to no.

All subsequent ssh logins will now REQUIRE you to use an ssh key and will not prompt for a password. Ensure your ssh key works before doing this if you have no local access! There's no need to restart the ssh daemon or anything because it is started on demand for each new incoming connection. Note that you may also see a PasswordAuthentication line, but that defaults to no already.

If your ssh keys aren't working then that's a separate issue really, but this answers the question as it is posed now :)

Improve this answer
4
  • I also need to add the user to the AllowUser setting. I can only guess the GUI setup didn't also modify this text line. – Jason Jul 31 '12 at 17:28
  • 8
    Note, in later versions of Mac OS X (definitely in El Capitan), sshd_config has been moved to /etc/ssh/. – zelk Feb 19 '16 at 0:47
  • 3
    Note, as of MacOS Sierra (v10.12.x), the default for PasswordAuthentication has changed to yes, so be sure to change it to no. – Travis Clarke Apr 14 '17 at 19:58
  • @TravisClarke Can confirm for 10.15 (Catalina). So this remains a requirement. – sherrellbc Sep 14 '20 at 18:04
4

To update the answer for macOS Sierra (10.12.6 specifically), it appears the config file is now /etc/ssh/sshd_config

2 lines must be uncommented+modified to fully disable password authentication: (These are lines 57 through 62, inclusive, in the default sshd_config file)

# To disable tunneled clear text passwords, change to no here!
PasswordAuthentication no
#PermitEmptyPasswords no

# Change to no to disable s/key passwords
ChallengeResponseAuthentication no

As mentioned before, you may enable/disable ssh access from the System Preferences.app GUI, and no restart of the daemon is required between editing the configuration.

Improve this answer
2

On a test system here, disabling the SSH prompt required the following two lines to be added to /etc/sshd_config:

PasswordAuthentication no
ChallengeResponseAuthentication no

The comments in sshd_config also advise the following line be added:

UsePAM no
Improve this answer
1

You should check the permissions of the directories involved: /Users/remotepair/ and /Users/remotepair/.ssh, they must not allow write access by "other" users. My .ssh has access rights only for the owner.

Also, on the remote system, do a ssh -v remotepair@yoursystem to see which authorization methods are allowed and attempted. Lookout for Authentications that can continue: publickey,password,keyboard-interactive. Maybe you must enable RSAAuthentication on your system.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .