15

I have a Mac OS X machine (Mac mini running 10.5) with Remote Login enabled. I want to open the sshd port to the Internet to be able to login remotely.

For security reasons I want to disable remote logins using passwords, allowing only users with a valid public key to login.

What is the best way to set this up in Mac OS X?

20

After a little trial and error, I found the answer myself. These options need to be set in /etc/sshd_config:

PasswordAuthentication no
ChallengeResponseAuthentication no

Only changing one of them is not enough.

  • 3
    In El Capital (and probably in Mavericks as well), the location changed to /etc/ssh/sshd_config instead of just /etc/sshd_config – yorch Oct 25 '15 at 1:15
  • That was the fix. A LOT of online resources do not mention the key to this whole thing: ChallengeResponseAuthentication no. – the_real_one Mar 19 at 23:24
1

In /etc/ssh/sshd_config

# To disable tunneled clear text passwords, change to no here! Also,
# remember to set the UsePAM setting to 'no'.
#PasswordAuthentication yes
#PermitEmptyPasswords no

Set PasswordAuthentication to no and remove the # before it.

  • Did you read the comment above about setting UsePAM to 'no'? – user21715 Nov 18 '09 at 18:47
  • That doesn't seem to be necessary (see my own answer). – Christian Berg Nov 18 '09 at 18:57
0

It's actually in /etc/sshd_config that you set the following line:

PasswordAuthentication no

If you are using a stock install (i.e., you didn't build/install it yourself from source), launchd should take care of picking up the new config without having to restart the daemon.

  • This is not working, I can still login with my password. The logfile /var/log/secure.log contains an entry like this: sshd[16306]: Accepted keyboard-interactive/pam for christian from 192.168.178.20 port 63841 ssh2 I believe the PasswordAuthentication option only controls clear-text password logins, not keyboard-interactive? – Christian Berg Nov 18 '09 at 18:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.