Recently while deploying a new MacPro with Mac OS X 10.6 Snow Leopard Server I encountered the following error in relation to the SFTP services.
Permission denied (publickey,keyboard-interactive) After considerable searching through numerous dead ends all leading to the accounts in question have expired I stumbled upon the correct answer. The user accounts in question were not part of the Administrators group, therefore; were not allowed access to the system through SFTP. The obvious method to correct this would be to add all of those users to the administrators group and walk away. WRONG!!!!No the correct thing to do is to open the Server Administration page and add this group of selected users to the allowed SFTP list. However when you open the Server Admin you won’t find an SFTP access section. SFTP access is actually part of the SSH protocol and provided by Apple’s port of OpenSSH to the system. In the following screen observe that I simply added the imagestaff group to the allowed list and saved the changes.
There are a few things worth noting about SSH and SFTP. Apple has bundled an anti brute force mechanism into the operating system called the Event Monitor Daemon or emond. Emond watches for unsuccessful login attempts via ssh and subsequently enters a temporary denial rule into the firewall. This rule denies ALL traffic from a specific IP address. That means if you have a remote office that connects to the server for other services like email, web and DNS these users will be cut off for the duration of the temporary rule. In my experience this temporary blacklisting lasts between 15 and 40 minutes.
This article is a work in progress and I will likely add more to it in the future. In addition I will likely relocate this to the Tehcnobabel pages.