0

I've just gone into Settings > Sharing on my Macintosh running OS X 10.9.5, and turned Remote Login On.

From my mobile phone, I've been able to access my computer using ssh by accessing myusername@192.***.*.** (and inputting my password), as my phone is on the same wifi network as my computer.

Once Remote Login is activated, could a malicious hacker on another wifi network that had managed to figure out my password gain access to my computer, or is my computer only accessible to people on my wifi network? I am worried that activating Remote Login may be a security risk.

1

Your computer is only accessible on your local wifi network with people who know your username and password.

A hacker can only access your computer (from outside your network) if you've previously set up port forwarding (forwarding requests from your external IP to your internal IP of your Mac) on your router to your Mac.

All IP's starting with 192 and 10 are local.

0

Yes, generally anyone on the network will be able to ssh to your account with username/password, NAT and network firewall issues aside.

If you want to secure your ssh server connection, you should setup a ssh key and then disable password based logins by editing your /etc/sshd_config file and disable (set to "no") the following options:

PasswordAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication no

Then you can still log in via your private key, but nobody will ever be able to login with only your password.

To be even more secure, disable root logins:

PermitRootLogin no

Be "hidden" by putting your ssh server on a different port:

Port <something-other-than-22>

In each case when modifying your sshd_config file, you will need to restart sshd:

$ sudo launchctl unload /System/Library/LaunchDaemons/ssh.plist
$ sudo launchctl load /System/Library/LaunchDaemons/ssh.plist

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.