Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have created a new local account, "jira", using the Workgroup Manager on my fairly newly installed Max OS X Server. In the list there are now two accounts: my main account created during system setup, and one new.

I can access the server using ssh and the first account but when I try to ssh to the server ("ns") using the second account ("jira") I get the following result:

ns:Users koenig$ ssh jira@localhost
Password:
Permission denied (publickey,gssapi-keyex,gssapi-with-mic,keyboard-interactive).

I have for the sake or argument opted to connect to localhost here but the same applies when I try the FQDN.

I have tried to google for the error message but to no avail. I have also tried to match the two accounts in the Workgroup Manager and as far as I can see they are equivalent (but for one being administrator and the other just user).

share|improve this question
    
This is not a programming question, ask on superuser.com –  teukkam Sep 21 '10 at 10:55
add comment

migrated from stackoverflow.com Sep 21 '10 at 15:25

This question came from our site for professional and enthusiast programmers.

3 Answers

up vote 2 down vote accepted

By default, OS X Server creates a service access control list (SACL) for SSH (and VNC) that only allows administrators to connect. To add other users and/or groups to the SACL, run Server Admin -> select the server name in the sidebar -> Access in the toolbar -> Services tab -> SSH in the service list. Note that the SACL controls in Server Admin are controlling the same thing you find in Server Preferences -> Users -> Services tab, except the Server Admin version gives you control over more services (like SSH) and allows you to add access by group, as well as per user.

share|improve this answer
add comment

To add a non-admin user to the SSH SACL from the command line, use:

$ sudo dseditgroup -o edit -a $user -t user com.apple.access_ssh

where $user is the username you want to gain SSH access

$ id $user

will subsequently list "399(com.apple.access_ssh)" as one of the groups the user is a member of.

Courtesy of http://inkhornnet.wordpress.com/2012/10/01/enable-ssh-for-new-non-admin-on-osx/ and http://macadmincorner.com/securing-ssh/.

share|improve this answer
add comment

SSH is not enabled by default on Mac OS X Server and Client. You need to enable remote access by enabling SSH access through the Sharing system preference and allowing remote login.

This question should be on Server Fault though.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.