Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 7 down vote favorite
1

I have a Mac OS X machine (Mac mini running 10.5) with Remote Login enabled. I want to open the sshd port to the Internet to be able to login remotely.

For security reasons I want to disable remote logins using passwords, allowing only users with a valid public key to login.

What is the best way to set this up in Mac OS X?

share|improve this question

3 Answers

up vote 5 down vote accepted

After a little trial and error, I found the answer myself. These options need to be set in /etc/sshd_config:

PasswordAuthentication no
ChallengeResponseAuthentication no

Only changing one of them is not enough.

share|improve this answer
up vote 1 down vote

In /etc/ssh/sshd_config

# To disable tunneled clear text passwords, change to no here! Also,
# remember to set the UsePAM setting to 'no'.
#PasswordAuthentication yes
#PermitEmptyPasswords no

Set PasswordAuthentication to no and remove the # before it.

share|improve this answer
Did you read the comment above about setting UsePAM to 'no'? – user21715 Nov 18 '09 at 18:47
That doesn't seem to be necessary (see my own answer). – Christian Berg Nov 18 '09 at 18:57
up vote 0 down vote

It's actually in /etc/sshd_config that you set the following line:

PasswordAuthentication no

If you are using a stock install (i.e., you didn't build/install it yourself from source), launchd should take care of picking up the new config without having to restart the daemon.

share|improve this answer
This is not working, I can still login with my password. The logfile /var/log/secure.log contains an entry like this: sshd[16306]: Accepted keyboard-interactive/pam for christian from 192.168.178.20 port 63841 ssh2 I believe the PasswordAuthentication option only controls clear-text password logins, not keyboard-interactive? – Christian Berg Nov 18 '09 at 18:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.