SSH into your VPS from a Mac with Terminal

Every Mac comes with an SSH client built in, so you can manage a Linux VPS without installing anything. This guide shows how to connect from Terminal, set up key login, have macOS remember your key passphrase in the Keychain, and save shortcuts so a server is only two words away.

Before you start

• Your VPS IP address, username and password from the service page in your VPS provider's control panel.
• A Mac with a current version of macOS.
• Terminal (in Applications → Utilities, or press Cmd + Space and type Terminal). iTerm2 is a popular free alternative with split panes and better search; everything below works the same in it.

Connect with a password

Open Terminal and run:

ssh root@203.0.113.10

If your server listens on a different SSH port, add -p:

ssh -p 2222 root@203.0.113.10

On the first connection, macOS shows the server's key fingerprint and asks:

Are you sure you want to continue connecting (yes/no/[fingerprint])?

Type yes and press Return. The key is saved in ~/.ssh/known_hosts so you are warned if it ever changes.

Enter your password. Nothing appears while you type, which is normal. You can paste it with Cmd + V. When the prompt changes to something like root@vps1:~#, you are in.

Type exit or press Ctrl + D to log out.

Create an SSH key

Keys are safer than passwords. Generate an Ed25519 key:

ssh-keygen -t ed25519 -C "you@mac"

Accept the default path (~/.ssh/id_ed25519) and set a passphrase. You now have:

• ~/.ssh/id_ed25519: the private key. Keep it on your Mac.
• ~/.ssh/id_ed25519.pub: the public key, which goes on the server.

Copy the public key to the server with ssh-copy-id, which macOS includes:

ssh-copy-id root@203.0.113.10

For a custom port:

ssh-copy-id -p 2222 root@203.0.113.10

Enter the server password one last time. Now ssh root@203.0.113.10 asks for the key's passphrase instead. For background on keys, see Set up SSH keys.

Store the passphrase in the Keychain

Apple's SSH can save your key passphrase in the macOS Keychain, so you never have to type it again on this Mac. Add the key once:

ssh-add --apple-use-keychain ~/.ssh/id_ed25519

On older macOS versions the option is -K instead of --apple-use-keychain.

To load the key from the Keychain automatically after every restart, add these lines at the top of ~/.ssh/config (create the file if it does not exist):

Host *
    UseKeychain yes
    AddKeysToAgent yes
    IdentityFile ~/.ssh/id_ed25519

Save shortcuts in the SSH config file

Add a block for each server to ~/.ssh/config:

Host web
    HostName 203.0.113.10
    User deploy
    Port 22

Now connect with:

ssh web

The shortcut works for scp, sftp and rsync too, for example scp backup.tar.gz web:~/. Make sure the file is private:

chmod 600 ~/.ssh/config

See Use the SSH config file to save hosts for more options.

Terminal tips on a Mac

• Copy and paste: Cmd + C and Cmd + V. Ctrl + C sends an interrupt to the server, it does not copy.
• Option as Meta: some editors and shells use the Alt key. In Terminal, go to Settings → Profiles → Keyboard and tick Use Option as Meta key. In iTerm2, set the left Option key to Esc+ under Profiles → Keys.
• Keep idle sessions alive: add ServerAliveInterval 60 under Host * in ~/.ssh/config to stop Wi-Fi changes and NAT timeouts dropping a quiet connection.
• Several servers at once: Cmd + T opens a new tab. In iTerm2, Cmd + D splits the window.

Check it works

Run a command on the server without opening a session:

ssh web 'hostname && uptime'

You should see the server's hostname and uptime with no password or passphrase prompt.

Troubleshooting

• Operation timed out or Connection refused: the server is off, the IP or port is wrong, or a firewall blocks SSH. Check the server in your VPS provider's control panel. See Fix SSH connection refused or timed out.
• WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!: expected after an OS reinstall. Remove the old key with ssh-keygen -R 203.0.113.10. If you did not reinstall, investigate before connecting.
• Permission denied (publickey): the server does not have your public key for that user. Run ssh-copy-id again, or check ~/.ssh/authorized_keys on the server.
• Bad configuration option: usekeychain: you are using a non-Apple OpenSSH, for example from Homebrew. Add IgnoreUnknown UseKeychain above the UseKeychain line, or use /usr/bin/ssh.
• Asked for the passphrase after every restart: add UseKeychain yes and AddKeysToAgent yes to your config as shown above.