29

I'm trying to SSH from one Mac running OS X 10.6 to another. Seems to work fine via a password, but I can't get it to use a RSA key instead. Where is the ssh configuration file on OS X and what is the command to reload SSH?

Update

What I'm asking is how to configured advanced options. For example, on Ubuntu there is a ssh config file at /etc/ssh/sshd_config and if you do something like change the port or disable password authentication for a particular user (PasswordAuthentication no) you need to run /etc/init.d/ssh reload to reload the config. I didn't see that file on MacOs, so was just wondering where it was.

I am aware of the ~/.ssh, ~/.ssh/authorized_keys, and ~/.ssh/config config files

3
  • By ssh configuration file, do you mean ~/.ssh/authorized_keys, the same file as on any platform?
    – Daniel Beck
    Dec 3, 2011 at 20:10
  • 1
    And why do you want to reload SSH? Doesn't it suffice to update the authorized_keys file for the user account you want to log in as? Please describe the problem you're facing in more detail.
    – Daniel Beck
    Dec 3, 2011 at 20:15
  • 1
    On Ubuntu there is a ssh config file at /etc/ssh/sshd_config and if you do something like change the port or disable password authentication for a particular user (PasswordAuthentication no) you need to run /etc/init.d/ssh reload to reload the config. I didn't see that file on OS X, so was just wondering where it was. I am aware of the ~/.ssh ~/.ssh/authorized_keys and ``~/.ssh/config`
    – cwd
    Dec 4, 2011 at 0:30

5 Answers 5

46

The SSHD configuration is stored in

/private/etc/ssh/sshd_config

To stop and start SSHD:

sudo launchctl stop com.openssh.sshd
sudo launchctl start com.openssh.sshd
4
  • 3
    Not sure if this is just because of how my machine is setup or not, but as of OS X Mavericks the sshd service I needed to specify in launchctl is org.openbsd.ssh-agent Jul 24, 2014 at 12:18
  • 5
    I think you mean /private/etc/ssh/sshd_config and /private/etc/ssh/ssh_config. Don't forget the ssh directory. Jan 14, 2016 at 21:12
  • my settings: alias restartsshd='sudo launchctl stop com.openssh.ssh-agent; sudo launchctl start com.openssh.ssh-agent;' Get the service name by using launchctl list | grep openssh
    – Marslo
    Jan 30, 2018 at 14:30
  • As of Catalina, you no longer need to restart the sshd service after a configuration change! At least for when setting PasswordAuthentication no, it appears to take effect as soon as the file is saved. Nice!
    – Chris
    Nov 12, 2020 at 0:15
6

I found out that in macOS Monterey (12.0), if you just disable PasswordAuthentication, it will still ask for a password (in the keyboard-interactive mode). To fully disable it, you have to set two options in /etc/ssh/sshd_config:

PasswordAuthentication no
ChallengeResponseAuthentication no

And then restart SSH server with these commands:

sudo launchctl unload /System/Library/LaunchDaemons/ssh.plist
sudo launchctl load -w /System/Library/LaunchDaemons/ssh.plist

Or going to System Preferences -> Sharing and unchecking + checking "Remote Login".

1
  • I'm on Monterey and I've triple-checked these settings in /etc/ssh/sshd_config, but I can still login with a password as the admin user of the machine. Any way to disable that and only allow logins from authorized_keys? Apr 20, 2023 at 13:32
3

You can restart SSH somewhere in the sharing dialogs, but you don't have to. According to the man page on apple.com keys go to the ~/.ssh/authorized_keys file.

3

In OS X El Capitan 10.11, sshd_config is in /private/etc/ssh/sshd_config (same as /etc/ssh/sshd_config)

0

Note that in newer OS X releases it is not enough to enable "Remote login" in System Preferences > Sharing to allow SSH connections to your Mac if the firewall is running.

Go to System Preferences > Security & Privacy > Firewall > Firewall Options. You will see that "Remote login" is listed on the top and incoming connections are allowed. Contrary to expectations this is not sufficient. You have to add another program called /usr/libexec/sshd-keygen-wrapper as well (locate its directory with [Shift-Cmd-G]), using the [+] button and then set "Allow incoming connections" for it. Now you'll be able to SSH into your machine.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .