up vote 3 down vote favorite
share [g+] share [fb]

I have a Mac OS X machine (Mac mini running 10.5) with Remote Login enabled. I want to open the sshd port to the Internet to be able to login remotely.

For security reasons I want to disable remote logins using passwords, allowing only users with a valid public key to login.

What is the best way to set this up in Mac OS X?

link|improve this question
feedback

3 Answers

up vote 3 down vote accepted

After a little trial and error, I found the answer myself. These options need to be set in /etc/sshd_config:

PasswordAuthentication no
ChallengeResponseAuthentication no

Only changing one of them is not enough.

link|improve this answer
feedback
up vote 0 down vote

In /etc/ssh/sshd_config

# To disable tunneled clear text passwords, change to no here! Also,
# remember to set the UsePAM setting to 'no'.
#PasswordAuthentication yes
#PermitEmptyPasswords no

Set PasswordAuthentication to no and remove the # before it.

link|improve this answer
Did you read the comment above about setting UsePAM to 'no'? – user21715 Nov 18 '09 at 18:47
That doesn't seem to be necessary (see my own answer). – Christian Berg Nov 18 '09 at 18:57
feedback
up vote 0 down vote

It's actually in /etc/sshd_config that you set the following line:

PasswordAuthentication no

If you are using a stock install (i.e., you didn't build/install it yourself from source), launchd should take care of picking up the new config without having to restart the daemon.

link|improve this answer
This is not working, I can still login with my password. The logfile /var/log/secure.log contains an entry like this: sshd[16306]: Accepted keyboard-interactive/pam for christian from 192.168.178.20 port 63841 ssh2 I believe the PasswordAuthentication option only controls clear-text password logins, not keyboard-interactive? – Christian Berg Nov 18 '09 at 18:33
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.