Getting into a Linux server from a Mac

To reach a Linux server from a Mac you need no new software at all. The client is built in; the work is keys, a config file, and which error means what.

Abhinav BaldhaFounder, MacServeUpdated 14 September 20262 min read

You do not need to install anything

macOS ships with OpenSSH. Open Terminal and ssh you@your-server works today. There is no client to download, and the third-party SSH apps for macOS are wrappers around the same thing with a window around it.

That is worth saying plainly, because "mac ssh client" is a search that leads to a lot of downloads for a program you already have.

Use a key, not a password

A password prompt on a public SSH port is a machine being guessed at continuously. A key removes the prompt and the guessing at once.

Make a key. ed25519 is the modern default and produces a short one.
Send the public half to the server. The private half, the file without .pub, never leaves your Mac.
Fix the permissions if SSH refuses it. OpenSSH ignores keys that anyone else on the machine could read.

1. Make the key

ssh-keygen -t ed25519

2. Install the public half on the server

ssh-copy-id you@your-server

3. If it is refused: ~/.ssh must be 700 and the private key 600

chmod 700 ~/.ssh && chmod 600 ~/.ssh/id_ed25519

Make it one word instead of a line

Everything about a connection can live in ~/.ssh/config, so that ssh box is enough. A host entry takes a HostName, a User, a Port and an IdentityFile, and from then on those are the defaults.

Two settings worth adding while you are there. ServerAliveInterval 30 stops a home router silently dropping an idle session. AddKeysToAgent yes together with UseKeychain yes lets macOS unlock a passphrase-protected key from the Keychain rather than asking every time.

For work that must survive the connection dropping, start tmux on the server and reattach after; a session that lives on the server does not care that your laptop closed.

A config worth copying

Put this in ~/.ssh/config, make the file 600, and ssh box is the whole command from then on. Every flag you would otherwise retype lives here instead.

The entry itself

Host box
  HostName 203.0.113.10
  User you
  Port 2222
  IdentityFile ~/.ssh/id_ed25519
  AddKeysToAgent yes
  UseKeychain yes
  ServerAliveInterval 30

Making repeat connections instant

Once you connect to the same host several times an hour, connection sharing is worth the three lines. The first ssh opens a connection, and every one after it reuses that instead of doing a fresh handshake.

Add to the same Host entry. Create ~/.ssh/cm first, or point it somewhere that exists.

  ControlMaster auto
  ControlPath ~/.ssh/cm/%r@%h:%p
  ControlPersist 10m

mkdir -p ~/.ssh/cm

Moving files between the Mac and the server

scp still works for one file. For anything repeated, rsync is better: it copies only what changed and can be restarted without starting over.

Finder's Connect to Server does not speak SFTP. It offers SMB, AFP, FTP and WebDAV, and SSH is not among them. Mounting a Linux server in Finder therefore needs a third-party tool, which is why most people stay in the terminal for this.

If you want to edit rather than copy, VS Code's Remote-SSH extension opens a folder on the server and runs the editor's backend there, using the same ~/.ssh/config entry you already made.

One file

scp ./file.txt you@your-server:~/

A folder, repeatedly. Only what changed is sent, and an interrupted run resumes.

rsync -av --progress ./site/ you@your-server:~/site/

The four SSH errors you will actually hit

Almost every SSH problem is one of these, and each one means something specific.

Connection refusedSomething answered. The host is reachable and nothing is listening on that port. Either the SSH service is stopped, or you have the wrong port.
Connection timed outNothing answered at all. A firewall, a wrong address, or a machine that is not on. This is the failure to expect when a port was never forwarded.
Permission denied (publickey)You reached the SSH service and it did not accept your key. Check the key is in the server's authorized_keys, that you are connecting as the right user, and the permissions above.
REMOTE HOST IDENTIFICATION HAS CHANGEDThe server's fingerprint is not the one you saw last time. That is either a rebuilt server or someone in the middle, and the only safe move is to confirm the new fingerprint out of band before removing the old line from ~/.ssh/known_hosts.

When the Linux server is the Mac

All of the above assumes the Linux machine is somewhere else. It does not have to be. It does not have to be. A Mac can run the Linux server itself, in a virtual machine, and the same ssh command still reaches it, from the next room or from anywhere else. The hardware sits on your desk, and the disk is your own SSD.

The connection details do not change. It is still OpenSSH, still a key, still ~/.ssh/config.

Keep reading

Connect to your MacServe server over SSH What actually turns a Mac into a server