Logging for SSHD when started from Launchd with `-d` option? I'm working on OS X 10.8.5, fully patched. I have an updated OpenSSH server installed in /usr/local/sbin listening on port 1522. Connection attempts result in ssh_exchange_identification: Connection closed by remote host. sudo grep 'sshd' /var/log/* 2&gt;/dev/null at the server is returning almost nothing, so I'm trying to gather more information at the server on the cause.

According to man sshd(8), -d is debug mode and it sends verbose debug output to standard error. I added -d to ProgramArguments in the plist, but the plist also sets StandardErrorPath to /dev/null. So I'm guessing the debugging information is being discarded.

I checked launchctl(1) man page, but I don't see what I should do to modify StandardErrorPath so that its logged somewhere. The man page does not even discussed the name/value pair.

How should I change the configuration so the debug logging is logged somewhere, and I know where that "somewhere" is?



$ cat /System/Library/LaunchDaemons/ssh-7.1.plist
&lt;?xml version="1.0" encoding="UTF-8"?&gt;
&lt;!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&gt;
&lt;plist version="1.0"&gt;
&lt;dict&gt;
    &lt;key&gt;Disabled&lt;/key&gt;
    &lt;true/&gt;
    &lt;key&gt;Label&lt;/key&gt;
    &lt;string&gt;com.openssh.sshd-v7.1&lt;/string&gt;
    &lt;key&gt;Program&lt;/key&gt;
    &lt;string&gt;/usr/local/sbin/sshd&lt;/string&gt;
    &lt;key&gt;ProgramArguments&lt;/key&gt;
    &lt;array&gt;
        &lt;string&gt;-i -d&lt;/string&gt;
    &lt;/array&gt;
    &lt;key&gt;Sockets&lt;/key&gt;
    &lt;dict&gt;
            &lt;key&gt;Listeners&lt;/key&gt;
            &lt;dict&gt;
                    &lt;key&gt;SockServiceName&lt;/key&gt;
                    &lt;string&gt;1522&lt;/string&gt;
            &lt;/dict&gt;
    &lt;/dict&gt;
    &lt;key&gt;inetdCompatibility&lt;/key&gt;
    &lt;dict&gt;
        &lt;key&gt;Wait&lt;/key&gt;
        &lt;false/&gt;
    &lt;/dict&gt;
    &lt;key&gt;StandardErrorPath&lt;/key&gt;
    &lt;string&gt;/dev/null&lt;/string&gt;
    &lt;key&gt;SHAuthorizationRight&lt;/key&gt;
    &lt;string&gt;system.preferences&lt;/string&gt;
&lt;/dict&gt;
&lt;/plist&gt;
To add the -d argument to sshd, it should be added as a new element to the     array:

&lt;string&gt;-d&lt;/string&gt;


The section should look like:

&lt;key&gt;ProgramArguments&lt;/key&gt;
    &lt;array&gt;
        &lt;string&gt;-i&lt;/string&gt;
        &lt;string&gt;-d&lt;/string&gt;
    &lt;/array&gt;

Instead of editing the plist files directly, you can use /usr/libexec/PlistBuddy (-h to show help).
There is a utility script ssh-util.rb that can turn logging on/off. It is part of the OpenSSH-189 package found at: opensource.apple.com.

Link to ssh-util.rb

Here are the required commands to run (as produced from the ruby script):

/usr/bin/ruby ./ssh-util.rb -l on -v --debug --dryrun


or manually:

sudo /usr/libexec/PlistBuddy -c "add :ProgramArguments:2 string '-ddd'" /System/Library/LaunchDaemons/ssh.plist
sudo launchctl unload /System/Library/LaunchDaemons/ssh.plist
sudo launchctl load /System/Library/LaunchDaemons/ssh.plist
sudo touch /var/run/com.openssh.sshd-asl-enabled

When finished debugging,, you'll need to run either:

/usr/bin/ruby ./ssh-util.rb -l off -v --debug --dryrun 


or manually:

sudo /usr/libexec/PlistBuddy -c "Delete :ProgramArguments:2" /System/Library/LaunchDaemons/ssh.plist
sudo launchctl unload /System/Library/LaunchDaemons/ssh.plist
sudo launchctl load /System/Library/LaunchDaemons/ssh.plist
sudo rm -f /var/run/com.openssh.sshd-asl-enabled



Notes on OS X Logging