I have created a new local account, "jira", using the Workgroup Manager on my fairly newly installed Max OS X Server. In the list there are now two accounts: my main account created during system setup, and one new.

I can access the server using ssh and the first account but when I try to ssh to the server ("ns") using the second account ("jira") I get the following result:

ns:Users koenig$ ssh jira@localhost
Permission denied (publickey,gssapi-keyex,gssapi-with-mic,keyboard-interactive).

I have for the sake or argument opted to connect to localhost here but the same applies when I try the FQDN.

I have tried to google for the error message but to no avail. I have also tried to match the two accounts in the Workgroup Manager and as far as I can see they are equivalent (but for one being administrator and the other just user).

  • This is not a programming question, ask on superuser.com – teukkam Sep 21 '10 at 10:55

By default, OS X Server creates a service access control list (SACL) for SSH (and VNC) that only allows administrators to connect. To add other users and/or groups to the SACL, run Server Admin -> select the server name in the sidebar -> Access in the toolbar -> Services tab -> SSH in the service list. Note that the SACL controls in Server Admin are controlling the same thing you find in Server Preferences -> Users -> Services tab, except the Server Admin version gives you control over more services (like SSH) and allows you to add access by group, as well as per user.


To add a non-admin user to the SSH SACL from the command line, use:

$ sudo dseditgroup -o edit -a $user -t user com.apple.access_ssh

where $user is the username you want to gain SSH access

$ id $user

will subsequently list "399(com.apple.access_ssh)" as one of the groups the user is a member of.

Courtesy of http://inkhornnet.wordpress.com/2012/10/01/enable-ssh-for-new-non-admin-on-osx/ and http://macadmincorner.com/securing-ssh/.


SSH is not enabled by default on Mac OS X Server and Client. You need to enable remote access by enabling SSH access through the Sharing system preference and allowing remote login.

This question should be on Server Fault though.


You can use the GUI to enable SSH for all non-Admin users

  1. System Preferences
  2. Sharing
  3. Enable Remote Login (for "All Users")

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.