4 ms·

Apple frequently introduces changes to its OS that caters to the average user without any hindsight for developers. A good example I had to deal with; I wanted

by jcfrei 9y ago

Apple frequently introduces changes to its OS that caters to the average user without any hindsight for developers. A good example I had to deal with; I wanted to change the port the SSH daemon listens on. With El Capitan and future versions you have to temporarily disable SIP (System Integrity Protection) - which requires two reboots - in order to make the change to the ssh.plist file. As you can see it's a common problem: https://apple.stackexchange.com/a/208481 https://apple.stackexchange.com/a/208481 It's lots of little things like this that require extra effort on OSX but which are straightforward on a decent Linux distro.

voltagex_ 9y ago
Is there anything stopping you using a separate sshd to run on a different port? Or using one from homebrew instead of Apple's bundled one?
no_wizard 9y ago
Flatly, This isn't true. I can still go into /etc/ssh sudo vim sshd_config, can my values, and they stick. Just to test it, I did it right now, and I'm running 10.13.4, for what its worth. What exactly was the issue with changing the sshd config? This isn't a SIP protected directory, which is the only thing that would prevent such a move. Perhaps the requirement of sudo? I feel like most linux distros force that in the /etc directory too.
- jcfrei 9y ago
  Changing /etc/ssh/sshd_config was my first attempt as well. But since this is OSX things are a little different, see here: https://serverfault.com/a/67616/ https://serverfault.com/a/67616/
fastball 9y ago
this security feature that is great for the vast majority of Apple's user's isn't convenient for me. Luckily, Apple shipped SIP with the option to disable it, and it's not hard. So you can disable it once and then you never need to deal with issues like that again. It's weird because it sounds like you want the protection of SIP without the inconvenience of SIP, but that's never been possible with pretty much any security measure ever -- more safety means less convenience. That being said, to me Apple has actually been the best when it comest to safety/convenience ratio. Linux distros don't even have the option of SIP or something similar, so I can't say I find your argument compelling.
- jcfrei 9y ago
  It's not the fact that the SIP is there which bothers me. It's that Apple introduces these kinds of things with little notice and without caring if they break compatibility. This has always been Apple's approach and it's just not friendly for developers.

by jcfrei 9y ago

voltagex_ 9y ago

Is there anything stopping you using a separate sshd to run on a different port? Or using one from homebrew instead of Apple's bundled one?

no_wizard 9y ago

Flatly, This isn't true. I can still go into /etc/ssh sudo vim sshd_config, can my values, and they stick. Just to test it, I did it right now, and I'm running 10.13.4, for what its worth. What exactly was the issue with changing the sshd config? This isn't a SIP protected directory, which is the only thing that would prevent such a move. Perhaps the requirement of sudo? I feel like most linux distros force that in the /etc directory too.

jcfrei 9y ago
Changing /etc/ssh/sshd_config was my first attempt as well. But since this is OSX things are a little different, see here: https://serverfault.com/a/67616/ https://serverfault.com/a/67616/

fastball 9y ago

this security feature that is great for the vast majority of Apple's user's isn't convenient for me. Luckily, Apple shipped SIP with the option to disable it, and it's not hard. So you can disable it once and then you never need to deal with issues like that again. It's weird because it sounds like you want the protection of SIP without the inconvenience of SIP, but that's never been possible with pretty much any security measure ever -- more safety means less convenience. That being said, to me Apple has actually been the best when it comest to safety/convenience ratio. Linux distros don't even have the option of SIP or something similar, so I can't say I find your argument compelling.

jcfrei 9y ago
It's not the fact that the SIP is there which bothers me. It's that Apple introduces these kinds of things with little notice and without caring if they break compatibility. This has always been Apple's approach and it's just not friendly for developers.