applesshandfilevault(7) — SSH and FileVault Description When FileVault is enabled on macOS: The data volume remains locked and inaccessible during boot and afterward until a user authenticates with a password. OpenSSH configuration files (both system-wide and per-account) reside on this locked data volume. Consequently, typical SSH authentication methods and shell access are unavailable until unlocking. However, if Remote Login is enabled: Users can authenticate via password using SSH even when the data volume is locked. This allows the data volume to be remotely unlocked over the network. Unlocking does not immediately establish an SSH session. macOS will briefly disconnect SSH while it mounts the data volume and starts dependent services. After this process, SSH and other enabled services are fully operational. History The ability to unlock the data volume remotely via SSH was introduced in macOS 26 Tahoe. See Also sshd(8) manual page for SSH daemon details. --- Document date: 1 July, 2025 Operating system:* Darwin