I resurrected my late 2012 Mac Mini recently and "upgraded" it to Mojave.

I can't even SSH into the box. The SSH daemon accepts connections, firewall is off, and login sharing is enabled. But the daemon refuses my key, my password. I can't even figure out how to get it to display the reasons for the denied access.

At least on Linux I can turn off the daemon, turn on logging, turn the daemon back on, and get somewhere with denied access.

I could be mistaken but I think you're crashing into Apple tightening up the security (in the good "require better encryption" way, not the bad "walled garden" way).

https://www.reddit.com/r/macsysadmin/comments/9wt05m/cannot_...

Aha! I had googled around a bunch but nothing helpful came about. You and @neilalexander are saying basically the same thing (I think). Thanks for the link! I'll check it out this evening :)

SSH is no different on macOS to Linux. Go and look in the usual places: /etc/ssh/sshd_config and /var/log. If you really are still stuck, disable Remote Login from the Sharing panel and start sshd yourself in a Terminal in verbose mode.

I don't think that's true. You have to screw around with launchctl. The original poster probably has to add the ability for a specific user to ssh to the box in "remote access"

The "Remote Login" checkbox in System Preferences actually does something equivalent to the `systemsetup` command. If you uncheck it, the daemon stops running, and you can then make changes or run it yourself.

This is what I'll do when I get home

You might find that running sshd in a Terminal is probably the best way to get a sense of what's really going on if the logging level isn't high enough by default - things like cipher disagreements would probably be visible on the client, whereas authentication errors are more likely to be logged on the target side. Do come back with how you get on!

So it turns out that I had deleted my shell, which also explains why iTerm and Terminal would instantly die.

Fixed it with `chsh` and now all that good stuff works \o/

Glad to hear it!

I think consumers don't give Apple enough credit for securing their OS because the other consumer-grade OS we compare it to was such a malware-magnet for decades that we've set our expectations low.

Several of the latest OSX releases have progressively locked down some executables/directories to Ring -1 (requires more than just root/sudo privs). I see it as Apple locking down the OS against potential malware, as I've always been able to work around their changes with some Stack-Overflow-fu.

SSHd is now very picky about permissions of the .ssh directory and underlying files and may quietly fail if they're not set properly.

very picky if you’re on a single user system. If you’re on a shared system, where admin has set default home permissions open, it makes complete sense to require .ssh to be 700.

Yup :) I learned this early on as a Linux user. It was the first thing I checked.

use ssh -vvv when you connect. Several types of ciphers were deprecated for security reasons over the past few releases, you can reenable them in /etc/ssh_config or /etc/sshd_config

I already used `ssh -v` and it didn't provide a whole lot of useful information.

If you add more v's, you get more info :)

The noise-dive Apple's software has taken, it might fall under the "treats like crap".

It's odd to me that so many people seem to dislike this comment. My experience with MacOS has gotten more and more negative with each update. I upgraded to Mojave a few weeks ago (because the OS would not stop nagging me to) and I've had nothing but problems since.

I've had nothing but problems using Windows, Linux and iOS. But that's not very solid in a thread with people talking about ads and privacy violations.

I've not seen a single nag to upgrade to Mojave. I'm still on Sierra (and will likely move to High Sierra this weekend - I like to stay a major version behind for Mac software for stability's sake on my Mac Mini).

I have gotten it 2-3 times in High Sierra, I normally operate on a 3-6mo delay on upgrades so that everyone else can deal with what breaks first.

Maybe the upgrade nag was added in High Sierra.

Nope. I'm running High Sierra, and it's all tumbleweeds about Mojave

Mojave is running great for me, what problems have you been experiencing?

It seems quite a few people have been turned off by the recent mac book pro fiasco as well.

Fiasco?

> Fiasco?

I don't know about the parent; but, as an MBP owner for almost 15 years, for me "fiasco" means "best-in-class keyboard and trackpad have become second- to third-rate." (Most complaints are focussed on the keyboard, and the Touch Bar's insistence on interfering with touch typing muscle memory; but I've found the trackpad has its own weird set of problems, at least on my machine.)

I think my old 2010 mbp (stolen in 2013) was probably my single favorite touchpad and keyboard for any laptop before or since. My current (late 2014) is okay, just not quite as good, and I don't like the newer ones at all... I use a physical keyboard at my desk and reducing the travel more and more just irritates me and slows me down.

May take a look at the Huawei Matebook X Pro, or it's successor next year. (Worries about chinese spying aside).

Keyboard

We clearly have different definitions for the word fiasco.

What "nose dive"? It has never been better.

Good points.

With macos, you need to buy the hardware, and the hardware locks you out of using Linux lately. You also have to spend like crazy on pre-upgrades since everything is soldered in. Then they fight tooth and nail to keep 3rd party repair from being viable, so the apple store says you need a fully new machine and yet the guy down the street can fix it for $700 (would be less but everything is soldered). The machines and os are great, but the other stuff is a buzz kill.

With red hat, I'm not sure its up to date enough for desktop use - dedoimedo likes to talk up his centos install but he doesn't actually recommend it. I'm going to look at red hat one day for production.

For desktop I would say SUSE is the way to go. You can get different levels of support. Much more worth it than Windows license - which is the price you pay to get Microsoft stickers on your machine (and to have their spyware on). Calling MS support was the worst experience ever for me. You shouldn't really use RHEL as a desktop OS (they even dropped KDE recently). On servers if you have the money RHEL is the best you can get.

I've never looked into SUSE. Could you elaborate on what they offer? All I know about them is that they are one of the really old enterprise distros and got purchased recently.