Hacker News Reader

Comment by inetknght | Hacker News Reader

I resurrected my late 2012 Mac Mini recently and "upgraded" it to Mojave.

I can't even SSH into the box. The SSH daemon accepts connections, firewall is off, and login sharing is enabled. But the daemon refuses my key, my password. I can't even figure out how to get it to display the reasons for the denied access.

At least on Linux I can turn off the daemon, turn on logging, turn the daemon back on, and get somewhere with denied access.

View on HN

I could be mistaken but I think you're crashing into Apple tightening up the security (in the good "require better encryption" way, not the bad "walled garden" way).

https://www.reddit.com/r/macsysadmin/comments/9wt05m/cannot_...

Aha! I had googled around a bunch but nothing helpful came about. You and @neilalexander are saying basically the same thing (I think). Thanks for the link! I'll check it out this evening :)

SSH is no different on macOS to Linux. Go and look in the usual places: /etc/ssh/sshd_config and /var/log. If you really are still stuck, disable Remote Login from the Sharing panel and start sshd yourself in a Terminal in verbose mode.

This is what I'll do when I get home

You might find that running sshd in a Terminal is probably the best way to get a sense of what's really going on if the logging level isn't high enough by default - things like cipher disagreements would probably be visible on the client, whereas authentication errors are more likely to be logged on the target side. Do come back with how you get on!

So it turns out that I had deleted my shell, which also explains why iTerm and Terminal would instantly die.

Fixed it with `chsh` and now all that good stuff works \o/

Glad to hear it!

I don't think that's true. You have to screw around with launchctl. The original poster probably has to add the ability for a specific user to ssh to the box in "remote access"

The "Remote Login" checkbox in System Preferences actually does something equivalent to the `systemsetup` command. If you uncheck it, the daemon stops running, and you can then make changes or run it yourself.

I think consumers don't give Apple enough credit for securing their OS because the other consumer-grade OS we compare it to was such a malware-magnet for decades that we've set our expectations low.

Several of the latest OSX releases have progressively locked down some executables/directories to Ring -1 (requires more than just root/sudo privs). I see it as Apple locking down the OS against potential malware, as I've always been able to work around their changes with some Stack-Overflow-fu.

SSHd is now very picky about permissions of the .ssh directory and underlying files and may quietly fail if they're not set properly.

Yup :) I learned this early on as a Linux user. It was the first thing I checked.

very picky if you’re on a single user system. If you’re on a shared system, where admin has set default home permissions open, it makes complete sense to require .ssh to be 700.

use ssh -vvv when you connect. Several types of ciphers were deprecated for security reasons over the past few releases, you can reenable them in /etc/ssh_config or /etc/sshd_config

I already used `ssh -v` and it didn't provide a whole lot of useful information.

If you add more v's, you get more info :)

Reply on news.ycombinator.com