3 ms·

I resurrected my late 2012 Mac Mini recently and "upgraded" it to Mojave. I can't even SSH into the box. The SSH daemon accepts connections, firewall is off, a

I resurrected my late 2012 Mac Mini recently and "upgraded" it to Mojave. I can't even SSH into the box. The SSH daemon accepts connections, firewall is off, and login sharing is enabled. But the daemon refuses my key, my password. I can't even figure out how to get it to display the reasons for the denied access. At least on Linux I can turn off the daemon, turn on logging, turn the daemon back on, and get somewhere with denied access.

danceparty 8y ago
use ssh -vvv when you connect. Several types of ciphers were deprecated for security reasons over the past few releases, you can reenable them in /etc/ssh_config or /etc/sshd_config
- inetknght 8y ago
  I already used `ssh -v` and it didn't provide a whole lot of useful information.
  - yellowapple 8y ago
    If you add more v's, you get more info :)
neilalexander 8y ago
SSH is no different on macOS to Linux. Go and look in the usual places: /etc/ssh/sshd_config and /var/log. If you really are still stuck, disable Remote Login from the Sharing panel and start sshd yourself in a Terminal in verbose mode.
- inetknght 8y ago
  This is what I'll do when I get home
  - neilalexander 8y ago
    You might find that running sshd in a Terminal is probably the best way to get a sense of what's really going on if the logging level isn't high enough by default - things like cipher disagreements would probably be visible on the client, whereas authentication errors are more likely to be logged on the target side. Do come back with how you get on!
    - inetknght 8y ago
      So it turns out that I had deleted my shell, which also explains why iTerm and Terminal would instantly die. Fixed it with `chsh` and now all that good stuff works \o/
      - neilalexander 8y ago
        Glad to hear it!
- PeterMikhailov 8y ago
  I don't think that's true. You have to screw around with launchctl. The original poster probably has to add the ability for a specific user to ssh to the box in "remote access"
  - neilalexander 8y ago
    The "Remote Login" checkbox in System Preferences actually does something equivalent to the `systemsetup` command. If you uncheck it, the daemon stops running, and you can then make changes or run it yourself.
Eric_WVGG 8y ago
I could be mistaken but I think you're crashing into Apple tightening up the security (in the good "require better encryption" way, not the bad "walled garden" way). https://www.reddit.com/r/macsysadmin/comments/9wt05m/cannot_ssh_into_mojave1014/e9numdz/ https://www.reddit.com/r/macsysadmin/comments/9wt05m/cannot_...
- inetknght 8y ago
  Aha! I had googled around a bunch but nothing helpful came about. You and @neilalexander are saying basically the same thing (I think). Thanks for the link! I'll check it out this evening :)
thrill 8y ago
SSHd is now very picky about permissions of the .ssh directory and underlying files and may quietly fail if they're not set properly.
- inetknght 8y ago
  Yup :) I learned this early on as a Linux user. It was the first thing I checked.
- marmaduke 8y ago
  very picky if you’re on a single user system. If you’re on a shared system, where admin has set default home permissions open, it makes complete sense to require .ssh to be 700.
thephyber 8y ago
I think consumers don't give Apple enough credit for securing their OS because the other consumer-grade OS we compare it to was such a malware-magnet for decades that we've set our expectations low. Several of the latest OSX releases have progressively locked down some executables/directories to Ring -1 (requires more than just root/sudo privs). I see it as Apple locking down the OS against potential malware, as I've always been able to work around their changes with some Stack-Overflow-fu.

danceparty 8y ago

use ssh -vvv when you connect. Several types of ciphers were deprecated for security reasons over the past few releases, you can reenable them in /etc/ssh_config or /etc/sshd_config

inetknght 8y ago
I already used `ssh -v` and it didn't provide a whole lot of useful information.
- yellowapple 8y ago
  If you add more v's, you get more info :)

neilalexander 8y ago

SSH is no different on macOS to Linux. Go and look in the usual places: /etc/ssh/sshd_config and /var/log. If you really are still stuck, disable Remote Login from the Sharing panel and start sshd yourself in a Terminal in verbose mode.

inetknght 8y ago
This is what I'll do when I get home
- neilalexander 8y ago
  You might find that running sshd in a Terminal is probably the best way to get a sense of what's really going on if the logging level isn't high enough by default - things like cipher disagreements would probably be visible on the client, whereas authentication errors are more likely to be logged on the target side. Do come back with how you get on!
  - inetknght 8y ago
    So it turns out that I had deleted my shell, which also explains why iTerm and Terminal would instantly die. Fixed it with `chsh` and now all that good stuff works \o/
    - neilalexander 8y ago
      Glad to hear it!
PeterMikhailov 8y ago
I don't think that's true. You have to screw around with launchctl. The original poster probably has to add the ability for a specific user to ssh to the box in "remote access"
- neilalexander 8y ago
  The "Remote Login" checkbox in System Preferences actually does something equivalent to the `systemsetup` command. If you uncheck it, the daemon stops running, and you can then make changes or run it yourself.

Eric_WVGG 8y ago

I could be mistaken but I think you're crashing into Apple tightening up the security (in the good "require better encryption" way, not the bad "walled garden" way). https://www.reddit.com/r/macsysadmin/comments/9wt05m/cannot_ssh_into_mojave1014/e9numdz/ https://www.reddit.com/r/macsysadmin/comments/9wt05m/cannot_...

inetknght 8y ago
Aha! I had googled around a bunch but nothing helpful came about. You and @neilalexander are saying basically the same thing (I think). Thanks for the link! I'll check it out this evening :)

thrill 8y ago

SSHd is now very picky about permissions of the .ssh directory and underlying files and may quietly fail if they're not set properly.

inetknght 8y ago
Yup :) I learned this early on as a Linux user. It was the first thing I checked.
marmaduke 8y ago
very picky if you’re on a single user system. If you’re on a shared system, where admin has set default home permissions open, it makes complete sense to require .ssh to be 700.

thephyber 8y ago

I think consumers don't give Apple enough credit for securing their OS because the other consumer-grade OS we compare it to was such a malware-magnet for decades that we've set our expectations low. Several of the latest OSX releases have progressively locked down some executables/directories to Ring -1 (requires more than just root/sudo privs). I see it as Apple locking down the OS against potential malware, as I've always been able to work around their changes with some Stack-Overflow-fu.