1
sudo systemsetup -getremotelogin          # 显示 On/Off
2
sudo systemsetup -setremotelogin on        # 如未开启则打开

1
sudo sh -c 'cat >/etc/ssh/sshd_config.d/010-keys-only.conf << "EOF"
2
# 仅允许公钥登录，彻底禁用口令/交互式/PAM 口令
3
PubkeyAuthentication yes
4
PasswordAuthentication no
5
KbdInteractiveAuthentication no
6
ChallengeResponseAuthentication no
7

8
# 严格要求仅公钥通过（更保险）
9
AuthenticationMethods publickey
10

11
# 一些常见的安全基线
12
PermitEmptyPasswords no
13
PermitRootLogin no
14
# 可选：只允许特定用户/组
15
# AllowUsers lk
16
EOF'

1
sudo /usr/sbin/sshd -t                         # 无输出即通过
2
sudo launchctl kickstart -k system/com.openssh.sshd   # 重新加载服务

1
Match User lk
2
    AuthenticationMethods publickey
3
    PasswordAuthentication no
4
    KbdInteractiveAuthentication no