LightAtom

ssh Command: Connect, Keys and Tunnels

Everything you need for SSH from a Mac: connecting, keys, the config file, the macOS keychain, and port forwarding.

ssh user@server.example.com

Connect to a server.

intermediate15 minNeeds: A server or Mac with SSH enabled

When to use it

Use ssh to work on remote servers, to reach other Macs with Remote Login on, to authenticate to Git hosts, and to tunnel a port securely.

Steps

  1. Connect

    The first time, ssh asks you to confirm the server's key fingerprint and saves it in ~/.ssh/known_hosts.
    ssh jane@203.0.113.10

  2. Create a key

    Ed25519 keys are short and strong. Set a passphrase.
    ssh-keygen -t ed25519 -C "jane@example.com"

  3. Install the public key on the server

    ssh-copy-id appends ~/.ssh/id_ed25519.pub to the server's authorized_keys.
    ssh-copy-id jane@203.0.113.10

  4. Keep the passphrase in the macOS keychain

    Add the key once; macOS remembers the passphrase.
    ssh-add --apple-use-keychain ~/.ssh/id_ed25519

  5. Save hosts in ~/.ssh/config

    Then ssh web is enough. Put this in ~/.ssh/config: Host web, HostName 203.0.113.10, User jane, IdentityFile ~/.ssh/id_ed25519, and under Host * add AddKeysToAgent yes and UseKeychain yes.

  6. Forward a port

    -L forwards a local port to a service reachable from the server, such as a database bound to the server's localhost.
    ssh -L 5433:localhost:5432 web

Output explained

On first connection:

The authenticity of host '203.0.113.10 (203.0.113.10)' can't be established.
ED25519 key fingerprint is SHA256:…
Are you sure you want to continue connecting (yes/no/[fingerprint])?

Compare the fingerprint with what the server's admin gives you before answering yes. If ssh later shows REMOTE HOST IDENTIFICATION HAS CHANGED, the server's key changed: expected after a reinstall, suspicious otherwise. Remove the old entry with ssh-keygen -R 203.0.113.10 only once you know why.

Options and variations

FlagMeaningExample
-p PORTConnect to another portssh -p 2222 jane@host
-i KEYUse a specific keyssh -i ~/.ssh/work_ed25519 host
-L L:HOST:RLocal port forwardssh -L 8080:localhost:80 host
-D PORTSOCKS proxy through the serverssh -D 1080 host
-J JUMPConnect via a jump hostssh -J bastion internal
-vVerbose, for debuggingssh -v host

Common errors

ErrorCauseFix
Permission denied (publickey)Key not acceptedSee the dedicated guide: load the key, check authorized_keys.
Connection refusedNo SSH server listeningEnable Remote Login or start sshd.
Connection timed outFirewall or wrong addressCheck the IP and that port 22 is allowed.

Do it in the app

LightAtom's connections view shows each SSH session from your Mac and the data it moves, including tunnels.

Frequently asked questions

How do I SSH from a Mac?

Open Terminal and run ssh user@host. macOS includes OpenSSH (9.9 on macOS 15), so nothing needs installing.

Where are SSH keys stored on a Mac?

In ~/.ssh: the private key (id_ed25519) and public key (id_ed25519.pub). The config file and known_hosts live there too.

How do I stop typing my SSH passphrase on a Mac?

Run ssh-add --apple-use-keychain ~/.ssh/id_ed25519 once and add UseKeychain yes and AddKeysToAgent yes to ~/.ssh/config.

Related

LightAtom team

The people who build LightAtom, a network monitor for macOS.