When I try to SSH to my computer, ssh fails with this error:

Mothership:~ kuyan$ ssh kuyan@localhost
Connection closed by ::1

This also happens when I attempt to SSH to my user from another computer. This message appears in Console when I attempt to connect:

12/12/12 3:44:30.468 PM sshd[2576]: fatal: ssh_sandbox_child: sandbox_init: dlopen(/usr/lib/libsandbox.1.dylib, 261): image not found [preauth]

Relevant information:

  • I'm using a different version of sshd than OS X provides, installed via brew install openssh - but this error occurs with both versions.
  • /usr/lib/libsandbox.1.dylib exists:

    Mothership:~ kuyan$ ls /usr/lib/libsandbox*
    /usr/lib/libsandbox.1.dylib /usr/lib/libsandbox.dylib
  • Here's my /etc/sshd_config. The relevant line seems to be UsePrivilegeSeparation: when uncommented and set to yes instead of sandbox, everything works A-OK.

  • Though I'm not using MacPorts, the error I'm getting is essentially the one here.
  • sshd version: OpenSSH_6.1p1, OpenSSL 0.9.8r 8 Feb 2011
  • When you configure OpenSSH before the build, you should include --with-libs="-lsandbox". The Macports and Homebrew folks should probably do the same. From building OpenSSH from scratch (see Building OpenSSH for OS X?), I know its not included on OS X but its needed to avoid fatal: ssh_sandbox_child: sandbox_init: dlopen(/usr/lib/libsandbox.1.dylib, 261): image not found [preauth]. I also think its the easiest way to avoid it rather than hacking the source code. – user83961 Aug 23 '15 at 22:46

dtruss shows:

2892/0xdc8e:  stat64("/usr/lib/libsandbox.1.dylib\0", 0x7FFF500DA5F0, 0x7FFF500DB500)        = -1 Err#2

which is ENOENT (No such file or directory) and the reason is probably that chroot already happened. If you are so foolish as to experiment by

sudo mkdir -p /var/empty/usr/lib
sudo cp /usr/lib/libsandbox.1.dylib /var/empty/usr/lib

You will move the crash to the next shlib not under /var/empty/

sshd[3256]: fatal: ssh_sandbox_child: sandbox_init: dlopen (/usr/lib/libsandbox.1.dylib, 261):
Library not loaded: /usr/lib/libsqlite3.dylib\\n  Referenced from: /usr/lib/libsandbox.1.dylib\\n  Reason: image not found [preauth]

If you persist with this madness

sudo cp /usr/lib/libsqlite3.dylib /usr/lib/libMatch.1.dylib /var/empty/usr/lib/

sshd will start to work again at least for SSH keys, passwords still don't work.

You can also edit /usr/local/etc/sshd_config changing

UsePrivilegeSeparation sandbox


UsePrivilegeSeparation yes

But outside of debugging purposes I don't suggest trying any of this.

  • 1
    Can you say more about why 'UsePrivilegeSeparation yes' is insufficient? Because right now that's the only option (AFAICT) if you want to use a non-standard sshd. – TJ Luoma May 2 '13 at 23:06
  • "This madness" is stock behavior from an OpenSSH download. I don't think the guy asking the question is doing anything special, other than using and building OpenSSH as intended by the OpenSSH team. – user83961 Aug 23 '15 at 20:40

I've fixed this problem in MacPorts' sshd by porting a patch from Apple's sshd (which can be found at http://opensource.apple.com/source/OpenSSH/OpenSSH-186/). Apple moved the function that calls sandbox_init(3) (which calls dlopen(3) internally) before the chroot(2) call that would make loading the library fail.

The required patches are

and openssh needs to be built with -D__APPLE_SANDBOX_NAMED_EXTERNAL__ in the preprocessor flags.

The failure to authenticate with passwords is because OS X doesn't support the required library functions to do that without using PAM. Setting UsePAM yes in your sshd_config should work (as should applying http://trac.macports.org/browser/trunk/dports/net/openssh/files/pam.patch, which changes the default to enabling PAM).

  • Why not configure with --with-libs="-lsandbox"? Its much easier than patching the source code. The dependency will ensure libsandbox is loaded by dyld(1) at load time. There will be no need to mess with dynamic loading at the wrong time. – user83961 Aug 23 '15 at 22:48
  • I just used the patches that Apple applies to the copy of OpenSSH they ship with OS X. They allow the use of a (possibly more specific, I couldn't quickly find the actual definition of kSBXProfilePureComputation) named sandbox, which needs to be loaded at runtime and requires moving the sandboxing before the chroot. So this is really more about (a) supporting a named sandbox rather than supporting sandboxing in general, which could be done with -lsandbox, and (b) aligning with the behavior of Apple's OpenSSH. – neverpanic Aug 24 '15 at 8:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .