SSH server not working after upgrade to MacOS High Sierra (11.3)

I'm a little (a lot) ****** at Apple. Gone are the days when things 'just worked'.


I have been using the built-in ssh server in MacOS (via "Remote Login" in the Sharing pane in System Preferences for a while now.


After upgrading to MacOS High Sierra, none of my clients can connect.


When they attempt to, they receive the message "ssh_exchange_identification: Connection closed by remote host"


When I examine the MacOS console, I see the message "fatal: Privilege separation user sshd does not exist".


Now, I did do one probably stupid thing after updating to MacOS High Sierra. I noticed a bunch of new users were created (and not hidden from me) in "Users and Groups". They appeared have been created by the upgrade to High Sierra - I did not create them and I am the only admin on my Mac. I deleted them. I'm not sure if one of those users was the "Privilege separation user ssh.." referred to above.


Thoughts?


Thanks in advance!

iMac (21.5-inch, Late 2013), macOS High Sierra (10.13)

Posted on Oct 21, 2017 5:05 PM

Reply
Question marked as Top-ranking reply

Posted on Oct 22, 2017 2:26 PM

I finally figured it out after a few days of trial and error.


You need to recreate the _sshd user in Directory Utility ...


The Directory Utility is hard to describe how to get to... Settings > Users & Groups > Click Login Options > Small button that says Network Account Server "Join..." Then a thin dialog opens up and the first of 3 buttons is the open. Then navigate to the third Map icon. And add your _sshd user here. I just copied the settings from another Mac.


It is possible to do it from the command line using dscl. But I couldn't find a way to export the record from one Mac to another...


A big pain in the ...

14 replies
Question marked as Top-ranking reply

Oct 22, 2017 2:26 PM in response to potatogod

I finally figured it out after a few days of trial and error.


You need to recreate the _sshd user in Directory Utility ...


The Directory Utility is hard to describe how to get to... Settings > Users & Groups > Click Login Options > Small button that says Network Account Server "Join..." Then a thin dialog opens up and the first of 3 buttons is the open. Then navigate to the third Map icon. And add your _sshd user here. I just copied the settings from another Mac.


It is possible to do it from the command line using dscl. But I couldn't find a way to export the record from one Mac to another...


A big pain in the ...

Oct 23, 2017 6:22 AM in response to jjennings089

That did the trick - you are strong with the Force!


Creating the _sshd user as shown in your screen shot immediately resolved the issue. So for others who come across this post - was the root cause here likely that *I* deleted the _sshd user in error as I mentioned in my earlier post? Or does the MacOS High Sierra upgrade actually delete that user?


Thanks again!

Oct 23, 2017 10:36 AM in response to potatogod

Apart from being paranoid, I learnt by experience that even though Apple made an excellent job letting the user upgrade, and most of the time everything ends up smoothly, in certain situation is better to do a clean install.

Why?

Simply because the user does not usually stare at the computer screen. He uses it. And using something generally wears it out.

Oct 23, 2017 1:23 AM in response to jjennings089

jjennings089 wrote:


The Directory Utility is hard to describe how to get to


Or simply search "Directory Utility" using Spotlight or open in Finder /System/Library/CoreServices/Applications


It is possible to do it from the command line using dscl. But I couldn't find a way to export the record from one Mac to another...


If you have another computer where the user in question exists, exporting its record from the command line issue


dsexport -r _sshd ~/Desktop/sshd.txt /Local/Default dsRecTypeStandard:Users


The output file is an ASCII text file and is placed on the user's Desktop. Copy the file sshd.txt onto the computer where the user is missing. Place it on the Desktop, for the purpose of this example. Open Terminal and issue


dsimport ~/Desktop/sshd.txt /Local/Default I


The final I means ignore the record if it exists. You can use O to overwrite it.

Just in case you don't have another computer, the following two lines are the raw content of the file sshd.txt


0x0A 0x5C 0x3A 0x2C dsRecTypeStandard:Users 8 dsAttrTypeStandard:NFSHomeDirectory dsAttrTypeStandard:GeneratedUID dsAttrTypeStandard:RecordName dsAttrTypeStandard:RealName dsAttrTypeStandard:PrimaryGroupID dsAttrTypeStandard:UniqueID dsAttrTypeStandard:Password dsAttrTypeStandard:UserShell
/var/empty:FFFFEEEE-DDDD-CCCC-BBBB-AAAA0000004B:_sshd,sshd:sshd Privilege separation:75:75:*:/usr/bin/false


this is the hexdump. Each line must be terminated with the Unix new line 0x0a (red highlighted in the code below)

If you want to use the lines above edit and save it with a text editor, like vi (in Terminal) or a GUI text editor TextEdit or BBedit. When using a GUI editor be sure to set Text Only


hexdump -C ~/Desktop/sshd.txt 
00000000  30 78 30 41 20 30 78 35  43 20 30 78 33 41 20 30  |0x0A 0x5C 0x3A 0|
00000010  78 32 43 20 64 73 52 65  63 54 79 70 65 53 74 61  |x2C dsRecTypeSta|
00000020  6e 64 61 72 64 3a 55 73  65 72 73 20 38 20 64 73  |ndard:Users 8 ds|
00000030  41 74 74 72 54 79 70 65  53 74 61 6e 64 61 72 64  |AttrTypeStandard|
00000040  3a 4e 46 53 48 6f 6d 65  44 69 72 65 63 74 6f 72  |:NFSHomeDirector|
00000050  79 20 64 73 41 74 74 72  54 79 70 65 53 74 61 6e  |y dsAttrTypeStan|
00000060  64 61 72 64 3a 47 65 6e  65 72 61 74 65 64 55 49  |dard:GeneratedUI|
00000070  44 20 64 73 41 74 74 72  54 79 70 65 53 74 61 6e  |D dsAttrTypeStan|
00000080  64 61 72 64 3a 52 65 63  6f 72 64 4e 61 6d 65 20  |dard:RecordName |
00000090  64 73 41 74 74 72 54 79  70 65 53 74 61 6e 64 61  |dsAttrTypeStanda|
000000a0  72 64 3a 52 65 61 6c 4e  61 6d 65 20 64 73 41 74  |rd:RealName dsAt|
000000b0  74 72 54 79 70 65 53 74  61 6e 64 61 72 64 3a 50  |trTypeStandard:P|
000000c0  72 69 6d 61 72 79 47 72  6f 75 70 49 44 20 64 73  |rimaryGroupID ds|
000000d0  41 74 74 72 54 79 70 65  53 74 61 6e 64 61 72 64  |AttrTypeStandard|
000000e0  3a 55 6e 69 71 75 65 49  44 20 64 73 41 74 74 72  |:UniqueID dsAttr|
000000f0  54 79 70 65 53 74 61 6e  64 61 72 64 3a 50 61 73  |TypeStandard:Pas|
00000100  73 77 6f 72 64 20 64 73  41 74 74 72 54 79 70 65  |sword dsAttrType|
00000110  53 74 61 6e 64 61 72 64  3a 55 73 65 72 53 68 65  |Standard:UserShe|
00000120  6c 6c 0a 2f 76 61 72 2f  65 6d 70 74 79 3a 46 46  |ll./var/empty:FF|
00000130  46 46 45 45 45 45 2d 44  44 44 44 2d 43 43 43 43  |FFEEEE-DDDD-CCCC|
00000140  2d 42 42 42 42 2d 41 41  41 41 30 30 30 30 30 30  |-BBBB-AAAA000000|
00000150  34 42 3a 5f 73 73 68 64  2c 73 73 68 64 3a 73 73  |4B:_sshd,sshd:ss|
00000160  68 64 20 50 72 69 76 69  6c 65 67 65 20 73 65 70  |hd Privilege sep|
00000170  61 72 61 74 69 6f 6e 3a  37 35 3a 37 35 3a 2a 3a  |aration:75:75:*:|
00000180  2f 75 73 72 2f 62 69 6e  2f 66 61 6c 73 65 0a     |/usr/bin/false.|

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

SSH server not working after upgrade to MacOS High Sierra (11.3)

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.