Overview

The Apple SSH User Policy gives users SSH access to managed Macs with their public keys. You list each user and their keys in the policy, and the Swif agent sets up the accounts, keys, and Remote Login on every assigned Mac.

Use it to give admins or support staff key-based SSH access to Macs, and to remove that access centrally when someone leaves or changes roles.

Important: The policy holds the full list of SSH users. When a user is removed from the list, or the policy is unassigned, they lose the SSH access the policy gave them. Swif never deletes accounts, and never changes keys it didn't add.

Requirements

Requirement	Details
Platform	macOS 13 or later
Device ownership	Company-owned Macs only. BYOD isn't supported.
Swif agent	Installed and running
Network	Users must be able to reach the Mac on the SSH port (TCP 22 by default)

What Swif sets up on each Mac

Situation	What Swif does
The account doesn't exist	Creates it as a standard user. The account is hidden from the login window, and has no password, so it can only sign in over SSH with a key.
The account already exists	Adds the listed keys to it. The account keeps the rights it already has.
Remote Login is off	Turns on Remote Login, so the Mac accepts SSH connections, and turns it off again when no SSH users are left
Remote Login only lets in some users (Allow access for: Only these users)	Adds the user to that list, and removes them when the access goes
You add or remove a key	Updates the keys Swif added to match the list
You remove a user from the list, or unassign the policy	Removes the keys Swif added. An account Swif created is disabled, not deleted. An account that already existed keeps its own password and keys.
An account or key wasn't added by Swif	Leaves it unchanged

Swif never deletes an account, and never makes an account an administrator. If you add a removed user back, Swif enables the same account again.

Don't turn off Remote Login in another policy

The Apple Sharing Restrictions Policy has an Allow Remote Login (SSH) setting. When it's off, Swif turns Remote Login off and keeps it off, which blocks the SSH access this policy sets up. Don't assign both to the same Macs, unless Allow Remote Login (SSH) is on.

Settings reference

SSH Users

Each entry is one user who can sign in over SSH.

Field	What to enter	Required
Username	The macOS short name of the account, such as `it.admin`	Yes
Public Keys	One to 100 OpenSSH public keys, one per entry	Yes

Username rules

Up to 32 characters
Lowercase letters, digits, _, ., or -
Must start with a letter
root, nobody, daemon, and swifteam (the Swif Admin account) can't be used

Public key rules

Use the format from an authorized_keys file, such as the contents of id_ed25519.pub. For example: ssh-ed25519 AAAAC3Nza... user@laptop
Add each key as its own entry. A user with a laptop and a desktop can have two keys.
Keys with options, such as command= or from= at the start of the line, aren't accepted.

Only add public keys (the .pub file). Never paste a private key into the policy.

Before you start

Collect each user's public key. Ask users to send their .pub file. If someone needs a new key, they can create one with:
```
ssh-keygen -t ed25519
```
Choose usernames that follow the rules above. If an account already exists on the Macs, use its exact short name.
Check your other policies. Make sure no policy assigned to the same Macs turns off Remote Login.
Check network access. Make sure users can reach the Macs on the SSH port, through your firewall or VPN if needed.

Create the policy

In Swif, go to Device Management > Policies, then select Create new policy > Configure a Policy.
Select Apple SSH User Policy.
Enter a clear name, such as Mac SSH – IT Admins.
Under SSH Users, add a user:
- Username: the account's short name
- Public Keys: one entry per key
Repeat for each user who needs access.
Save the policy.
Assign it to a device group of company-owned Macs.

To change access later, edit the policy and save it. Swif updates every assigned Mac.

Example configurations

Example 1: IT admins on all company Macs

Add two users to SSH Users:

Username: it.admin
- Public Keys: ssh-ed25519 AAAAC3Nza...1 alex@laptop
- Public Keys: ssh-ed25519 AAAAC3Nza...2 alex@desktop
Username: sam.ops
- Public Keys: ssh-ed25519 AAAAC3Nza...3 sam@laptop

If these accounts don't exist on a Mac, Swif creates them, hidden and without a password. Both admins can sign in over SSH with their keys.

Example 2: Remove a departing user

sam.ops leaves the team. Edit the policy, remove the sam.ops entry, and save. Sam loses SSH access on every assigned Mac. The account Swif created is disabled, not deleted, and is enabled again if you add Sam back.

Verify the policy

Test with a throwaway key before you give access to real users.

On your computer, create a test key:

ssh-keygen -t ed25519 -N "" -f ~/.ssh/qa_key

Copy the line in ~/.ssh/qa_key.pub into the policy as the public key of a test user, such as it.admin. Assign the policy to a Mac you can reach on port 22.
Wait a few minutes after the policy is sent to the Mac.
On the Mac, check that System Settings > General > Sharing > Remote Login is on.
Sign in:
```
ssh -i ~/.ssh/qa_key it.admin@<mac-ip>
```
The sign-in should succeed.
Remove it.admin from the policy, or unassign the policy. Then run this. It turns off password sign-in for the test, since macOS allows it over SSH by default:
```
ssh -o PasswordAuthentication=no -i ~/.ssh/qa_key it.admin@<mac-ip>
```
It should end with Permission denied (publickey), or Connection refused if Swif turned Remote Login off again.

When you're done, delete the test key:

rm ~/.ssh/qa_key ~/.ssh/qa_key.pub

Troubleshooting

The sign-in fails with Permission denied (publickey)

Wait a few minutes after the policy is sent, then try again.
Check that the key in the policy matches the private key you're using with ssh -i.
Check that the username matches the account's short name exactly.
Check that the user is still in the policy, and the policy is assigned to the Mac.

The connection times out or is refused

Check that the Mac is online, and your firewall or VPN allows the connection.
Check that Remote Login is on. If it keeps turning off, check for an Apple Sharing Restrictions Policy with Allow Remote Login (SSH) off on the same Mac.

Swif rejects the username

The name doesn't follow the username rules, or it's root, nobody, daemon, or swifteam. Choose another name.

Swif rejects a public key

Check that you pasted the public key (.pub), not the private key.
Remove any options at the start of the line, such as command= or from=.

Remote Login turned off after I removed the last SSH user

This is expected if Swif turned Remote Login on. Swif turns it off again when it no longer gives anyone SSH access. If Remote Login was already on before the policy, Swif leaves it on.

A removed user's account is still on the Mac

This is expected. Swif disables accounts it created, instead of deleting them. If you add the user back, the same account is enabled again.

The new account doesn't appear at the login window

This is expected. Accounts Swif creates are hidden and have no password, so they can only sign in over SSH.

The policy doesn't apply to a BYOD Mac

This is expected. The Apple SSH User Policy supports company-owned Macs only.

Apple SSH User Policy