Since you’ve gone to the trouble of making that script, would you be so kind as to put up a link to download it with some simple instructions? I think everyone who hates the current operation would appreciated your efforts.

I just spent the better part of an hour finally sitting down and digging into why launchd wasn’t honoring RunAtLoad=false or Disabled=true in the sshd plist; since SBSettings and the Cydia autostart were the only things starting at boot that weren’t from Apple, a “strings” across sbsettingsd revealed pretty clearly what was going on. Then, a little searching brought me to this article.

Seriously? You’re going out of your way to override the users’ explicitly-configured wishes?

For what it’s worth, my use case is straightforward: my work network doesn’t permit non-kerberized SSH daemons, and actively scans for them. If they detect one, the device is removed from the network, which makes for a nice surprise and a fair bit of annoyance when I’ve rebooted over a weekend and forgotten to manually disable sshd.

Since openssh wasn’t built with tcp wrappers, I can’t just block connections from the network in question to prevent the issue. Disabling sshd at boot is the next obvious option, since I can always enable it on demand, and I simply don’t care about recoverability: I’ll reinstall if needed. But, you’ve gone out of your way to remove that option.

Uninstalling openssh is overkill; I do use it, but enable it on demand. I’d prefer not to uninstall sbsettings over it, either, but I’m slowly getting there. My current workaround is a script that wraps sbsettingsd and disables sshd shortly after sbsettings enables it. Not perfect, but should be close enough as long as I don’t blindly upgrade sbsettingstoggles.

This might be a useful thing for novice users, but be damned if it’s not utterly frustrating for someone who understands what they’re doing and has a legitimate use case that’s being thwarted.

However the default password for NetaTalk is the same used via SSH, ‘alpine’. And with MobileTerminal broken on iOS 4.0 and Rock crippled, the easiest way to change your password is to install SSH so you can use remote terminal commands to do so. However once that’s done if you’re dedicated to using Netatalk and never SSH, then turning SSH on upon reboot is still just one more security hole. Sure, you can uninstall it, but… seriously? Just because I don’t foresee using it doesn’t mean that one wants to delete it!