Macos Openssh

Posted : admin On 1/3/2022
Openssh

Just for kicks, I wanted to try using an ECDSA key for ssh authentication. Unfortunately, the OpenSSH bundled with Mountain Lion (10.8) does not support ECDSA keys (nor can one even be generated with ssh-keygen.) The man pages for ssh-keygen and ssh-agent say they support ECDSA, but this is due to a naive man page generation assuming that since the OpenSSL library supports it, OpenSSH will too. Download Custom OpenSSH Mac OS X installer – prepared by Scott Anguish. For guided instructions on the install visit Building OpenSSH 2.9 on Mac OS X 10. OpenSSH is a free version of the SSH connectivity tools that technical users rely on. OpenSSH encrypts all traffic (including passwords) to effectively el.

Just for kicks, I wanted to try using an ECDSA key for ssh authentication. Unfortunately, the OpenSSH bundled with Mountain Lion (10.8) does not support ECDSA keys (nor can one even be generated with ssh-keygen.) The man pages for ssh-keygen and ssh-agent say they support ECDSA, but this is due to a naive man page generation assuming that since the OpenSSL library supports it, OpenSSH will too. Also, a PCI compliant OpenSSH isn’t bundled with OS X Lion (10.7) or older so this will also be useful for those users as well. Thankfully, Homebrew already has a recipe for installing an up-to-date OpenSSH so most of the work of upgrading is already done.

If you don’t already have Homebrew installed, follow its installation instructions first.

1. First we’ll need to add the system duplicates repository to Homebrew.

$ brew tap homebrew/dupes

Macos

Macos Openssl

2. Compile and install OpenSSH. I want to use a newer OpenSSL and all its optimizations, which Homebrew will happily provide via an option. Also, to make ssh-agent launchd and keychain compatible, there’s a nice undocumented option to apply the necessary patch before compiling too.

Mac Ssh Manager

Macos

$ brew install openssh --with-brewed-openssl --with-keychain-support

3. Like the caveat notes when brew finishes, you need to update the launchd plist for ssh-agent to use the new Homebrew binary. By replacing /usr/bin/ssh-agent with /usr/local/bin/ssh-agent

$ launchctl stop org.openbsd.ssh-agent
$ launchctl unload -w /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist
$ sudo vi /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist
$ launchctl load -w -S Aqua /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist

4. The SSH_AUTH_SOCK env var needs to be updated for any open or new terminal sessions. It’s best to logout/login or restart because we cannot modify the variables in the user session scope that all new processes inherit from. However, if that’s not an option, can do this instead.

$ export SSH_AUTH_SOCK=$(launchctl getenv SSH_AUTH_SOCK)

Openssh Download Mac Os

Macos Openssh

5. Generate an ECDSA key

$ ssh-keygen -t ecdsa -b 521

Macos Update Openssh

Once the pub key from your new ECDSA key pair is added to .ssh/authorized_keys on your server(s), should be good to go (assuming OpenSSH on your server also supports ECDSA keys.)

Macos Openssh Server

Here are openssl speed runs showing considerable improvements in the newer OpenSSL on a Late-2012 rMBP with a 2.9 Ghz i7 (Ivy Bridge):