What MSL changes to keep it safe
Password logins off, keys only, and nothing you cannot undo.
On this page 5 sections
A port 22 that faces the internet starts receiving automated password guessing within minutes. MSL's instances ship with password logins on, which is fine on your own network and not fine on a public address — so publishing changes that first.
What it changes#
MSL writes one file in the instance, /etc/ssh/sshd_config.d/00-msl-public.conf:
| Setting | Why |
|---|---|
PasswordAuthentication no | Password guessing becomes pointless |
KbdInteractiveAuthentication no | The same thing by another name |
PermitRootLogin prohibit-password | root by key only, never by password |
MaxAuthTries 3 | Fewer guesses per connection |
LoginGraceTime 20 | Connections that never log in get dropped |
AllowAgentForwarding no, AllowTcpForwarding no | A borrowed key reaches less |
Then it asks the SSH server what it actually believes, rather than trusting that writing the file was enough. If passwords are somehow still on, MSL refuses to publish and tells you. Writing a setting and having it take effect are not the same thing, and this is the difference between secured and apparently secured.
What someone who logs in can reach#
More than the Linux machine. MSL puts your Mac's home folder inside every instance, at /mnt/mac, and it is writable — that's what makes Linux apps able to open your Documents and save back to them.
An SSH login has exactly the same access an app in that instance does. So publishing an instance shares those files with whoever you let in, and the people you authorize should be people you would hand your Mac to.
Worth knowing before you hand out an address. It is not something MSL changes for you.
You cannot be locked out#
None of this can shut you out of your own instance. msl <instance> does not use SSH at all — it reaches the guest by a private channel between the Mac and the virtual machine. A lost key costs you a remote login, never the machine.
What stays yours#
The tunnel's own connection is kept away from your ~/.ssh entirely: MSL does not read your config and does not offer your private keys to a relay.
What MSL cannot promise#
- A free relay is somebody else's machine. Your SSH session is encrypted end to end inside it, so the relay cannot read it — but it can see that a connection exists. Use your own server if that matters.
- A closed lid still sleeps the Mac, and a sleeping Mac answers nothing.
- Anyone with the address can try. They will not get in without a key you allowed, but they can try.