Hacker News Reader

Comment by LeoPanthera | Hacker News Reader

I guess you're assigning "walled garden" to macOS, but macOS is still UNIX underneath, and you can run any open software you want on it.

I still think it's an excellent option for the privacy conscious.

There are plenty of free software based operating systems that will take your money. Red Hat seems like the most obvious one.

View on HN

I resurrected my late 2012 Mac Mini recently and "upgraded" it to Mojave.

I can't even SSH into the box. The SSH daemon accepts connections, firewall is off, and login sharing is enabled. But the daemon refuses my key, my password. I can't even figure out how to get it to display the reasons for the denied access.

At least on Linux I can turn off the daemon, turn on logging, turn the daemon back on, and get somewhere with denied access.

use ssh -vvv when you connect. Several types of ciphers were deprecated for security reasons over the past few releases, you can reenable them in /etc/ssh_config or /etc/sshd_config

I already used `ssh -v` and it didn't provide a whole lot of useful information.

If you add more v's, you get more info :)

SSH is no different on macOS to Linux. Go and look in the usual places: /etc/ssh/sshd_config and /var/log. If you really are still stuck, disable Remote Login from the Sharing panel and start sshd yourself in a Terminal in verbose mode.

This is what I'll do when I get home

You might find that running sshd in a Terminal is probably the best way to get a sense of what's really going on if the logging level isn't high enough by default - things like cipher disagreements would probably be visible on the client, whereas authentication errors are more likely to be logged on the target side. Do come back with how you get on!

So it turns out that I had deleted my shell, which also explains why iTerm and Terminal would instantly die.

Fixed it with `chsh` and now all that good stuff works \o/

Glad to hear it!

I don't think that's true. You have to screw around with launchctl. The original poster probably has to add the ability for a specific user to ssh to the box in "remote access"

The "Remote Login" checkbox in System Preferences actually does something equivalent to the `systemsetup` command. If you uncheck it, the daemon stops running, and you can then make changes or run it yourself.

I could be mistaken but I think you're crashing into Apple tightening up the security (in the good "require better encryption" way, not the bad "walled garden" way).

https://www.reddit.com/r/macsysadmin/comments/9wt05m/cannot_...

Aha! I had googled around a bunch but nothing helpful came about. You and @neilalexander are saying basically the same thing (I think). Thanks for the link! I'll check it out this evening :)

SSHd is now very picky about permissions of the .ssh directory and underlying files and may quietly fail if they're not set properly.

Yup :) I learned this early on as a Linux user. It was the first thing I checked.

very picky if you’re on a single user system. If you’re on a shared system, where admin has set default home permissions open, it makes complete sense to require .ssh to be 700.

I think consumers don't give Apple enough credit for securing their OS because the other consumer-grade OS we compare it to was such a malware-magnet for decades that we've set our expectations low.

Several of the latest OSX releases have progressively locked down some executables/directories to Ring -1 (requires more than just root/sudo privs). I see it as Apple locking down the OS against potential malware, as I've always been able to work around their changes with some Stack-Overflow-fu.

The noise-dive Apple's software has taken, it might fall under the "treats like crap".

It seems quite a few people have been turned off by the recent mac book pro fiasco as well.

Fiasco?

Keyboard

We clearly have different definitions for the word fiasco.

> Fiasco?

I don't know about the parent; but, as an MBP owner for almost 15 years, for me "fiasco" means "best-in-class keyboard and trackpad have become second- to third-rate." (Most complaints are focussed on the keyboard, and the Touch Bar's insistence on interfering with touch typing muscle memory; but I've found the trackpad has its own weird set of problems, at least on my machine.)

I think my old 2010 mbp (stolen in 2013) was probably my single favorite touchpad and keyboard for any laptop before or since. My current (late 2014) is okay, just not quite as good, and I don't like the newer ones at all... I use a physical keyboard at my desk and reducing the travel more and more just irritates me and slows me down.

May take a look at the Huawei Matebook X Pro, or it's successor next year. (Worries about chinese spying aside).

What "nose dive"? It has never been better.

It's odd to me that so many people seem to dislike this comment. My experience with MacOS has gotten more and more negative with each update. I upgraded to Mojave a few weeks ago (because the OS would not stop nagging me to) and I've had nothing but problems since.

I've had nothing but problems using Windows, Linux and iOS. But that's not very solid in a thread with people talking about ads and privacy violations.

I've not seen a single nag to upgrade to Mojave. I'm still on Sierra (and will likely move to High Sierra this weekend - I like to stay a major version behind for Mac software for stability's sake on my Mac Mini).

Maybe the upgrade nag was added in High Sierra.

Nope. I'm running High Sierra, and it's all tumbleweeds about Mojave

I have gotten it 2-3 times in High Sierra, I normally operate on a 3-6mo delay on upgrades so that everyone else can deal with what breaks first.

Mojave is running great for me, what problems have you been experiencing?

Good points.

With macos, you need to buy the hardware, and the hardware locks you out of using Linux lately. You also have to spend like crazy on pre-upgrades since everything is soldered in. Then they fight tooth and nail to keep 3rd party repair from being viable, so the apple store says you need a fully new machine and yet the guy down the street can fix it for $700 (would be less but everything is soldered). The machines and os are great, but the other stuff is a buzz kill.

With red hat, I'm not sure its up to date enough for desktop use - dedoimedo likes to talk up his centos install but he doesn't actually recommend it. I'm going to look at red hat one day for production.

For desktop I would say SUSE is the way to go. You can get different levels of support. Much more worth it than Windows license - which is the price you pay to get Microsoft stickers on your machine (and to have their spyware on). Calling MS support was the worst experience ever for me. You shouldn't really use RHEL as a desktop OS (they even dropped KDE recently). On servers if you have the money RHEL is the best you can get.

I've never looked into SUSE. Could you elaborate on what they offer? All I know about them is that they are one of the really old enterprise distros and got purchased recently.

Reply on news.ycombinator.com