MacOS – ssh fails: image not found [preauth]

homebrewmacosssh

When I try to SSH to my computer, ssh fails with this error:

Mothership:~ kuyan$ ssh kuyan@localhost
Connection closed by ::1

This also happens when I attempt to SSH to my user from another computer.
This message appears in Console when I attempt to connect:

12/12/12 3:44:30.468 PM sshd[2576]: fatal: ssh_sandbox_child: sandbox_init: dlopen(/usr/lib/libsandbox.1.dylib, 261): image not found [preauth]

Relevant information:

  • I'm using a different version of sshd than OS X provides, installed via brew install openssh – but this error occurs with both versions.

  • /usr/lib/libsandbox.1.dylib exists:

    Mothership:~ kuyan$ ls /usr/lib/libsandbox*
/usr/lib/libsandbox.1.dylib /usr/lib/libsandbox.dylib

  • Here's my /etc/sshd_config. The relevant line seems to be UsePrivilegeSeparation: when uncommented and set to yes instead of sandbox, everything works A-OK.

  • Though I'm not using MacPorts, the error I'm getting is essentially the one here.
  • sshd version: OpenSSH_6.1p1, OpenSSL 0.9.8r 8 Feb 2011

Best Answer

dtruss shows:

2892/0xdc8e:  stat64("/usr/lib/libsandbox.1.dylib\0", 0x7FFF500DA5F0, 0x7FFF500DB500)        = -1 Err#2

which is ENOENT (No such file or directory) and the reason is probably that chroot already happened. If you are so foolish as to experiment by

sudo mkdir -p /var/empty/usr/lib
sudo cp /usr/lib/libsandbox.1.dylib /var/empty/usr/lib

You will move the crash to the next shlib not under /var/empty/

sshd[3256]: fatal: ssh_sandbox_child: sandbox_init: dlopen (/usr/lib/libsandbox.1.dylib, 261):
Library not loaded: /usr/lib/libsqlite3.dylib\\n  Referenced from: /usr/lib/libsandbox.1.dylib\\n  Reason: image not found [preauth]

If you persist with this madness

sudo cp /usr/lib/libsqlite3.dylib /usr/lib/libMatch.1.dylib /var/empty/usr/lib/

sshd will start to work again at least for SSH keys, passwords still don't work.

You can also edit /usr/local/etc/sshd_config changing

UsePrivilegeSeparation sandbox

into

UsePrivilegeSeparation yes

But outside of debugging purposes I don't suggest trying any of this.

Related Question