Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Mac OS X machine (Mac mini running 10.5) with Remote Login enabled. I want to open the sshd port to the Internet to be able to login remotely.

For security reasons I want to disable remote logins using passwords, allowing only users with a valid public key to login.

What is the best way to set this up in Mac OS X?

share|improve this question
up vote 17 down vote accepted

After a little trial and error, I found the answer myself. These options need to be set in /etc/sshd_config:

PasswordAuthentication no
ChallengeResponseAuthentication no

Only changing one of them is not enough.

share|improve this answer
In El Capital (and probably in Mavericks as well), the location changed to /etc/ssh/sshd_config instead of just /etc/sshd_config – yorch Oct 25 '15 at 1:15

In /etc/ssh/sshd_config

# To disable tunneled clear text passwords, change to no here! Also,
# remember to set the UsePAM setting to 'no'.
#PasswordAuthentication yes
#PermitEmptyPasswords no

Set PasswordAuthentication to no and remove the # before it.

share|improve this answer
Did you read the comment above about setting UsePAM to 'no'? – user21715 Nov 18 '09 at 18:47
That doesn't seem to be necessary (see my own answer). – Christian Berg Nov 18 '09 at 18:57

It's actually in /etc/sshd_config that you set the following line:

PasswordAuthentication no

If you are using a stock install (i.e., you didn't build/install it yourself from source), launchd should take care of picking up the new config without having to restart the daemon.

share|improve this answer
This is not working, I can still login with my password. The logfile /var/log/secure.log contains an entry like this: sshd[16306]: Accepted keyboard-interactive/pam for christian from port 63841 ssh2 I believe the PasswordAuthentication option only controls clear-text password logins, not keyboard-interactive? – Christian Berg Nov 18 '09 at 18:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.