>

SSH into a server from macOS

A verified, step-by-step path to opening a secure shell on a remote server using the tools already on your Mac.

macOSsshsystemsetupssh-addsharingkeysssh-keygenMedium risk
Open Terminal and run ssh with your username and the server's address.

What this covers

Connecting to a server over SSH uses the client built into macOS. This guide walks through the checks worth doing first — confirming the server accepts SSH, verifying its host key, and optionally saving your key passphrase — then the actual login.

Make sure the server accepts SSH connections

If the machine you're connecting to is also a Mac, Remote Login must be enabled there before any ssh attempt will succeed. An administrator on the server can turn it on with systemsetup. You can tell it worked by seeing the server appear in System Settings under Sharing, or by simply trying the connection in the next step.

macOSTurn On Remote Login (SSH) with systemsetupMedium riskStep 1Optional

systemsetup -setremotelogin enables the macOS SSH server so you can log in from another machine.

Command
$ sudo systemsetup -setremotelogin on
▾ Undo
Undo
$ sudo systemsetup -setremotelogin off
Full explanation & undo →

Verify the host key before trusting the server

On first connect, ssh asks you to trust the server's host key. Computing the fingerprint beforehand with ssh-keygen lets you confirm you're connecting to the right machine, not an impostor. It worked when the fingerprint shown by ssh-keygen matches what the server administrator gave you.

macOSGet a Key or Host Fingerprint with ssh-keygen -lfLow riskStep 2Optional

Compute the SHA256 fingerprint of any SSH public key or remote host key for verification.

Command
$ ssh-keygen -lf ~/.ssh/id_ed25519.pub
# Fingerprint of a remote host key:
ssh-keyscan example.com | ssh-keygen -lf -
Full explanation & undo →

Store your SSH passphrase in the Keychain (optional)

If you log in with a key rather than a password, adding its passphrase to the macOS Keychain means ssh-agent loads it automatically, so you won't be prompted for it every time. You'll know it worked when a later ssh connection completes without asking for the passphrase.

macOSStore Your SSH Passphrase in the macOS KeychainLow riskStep 3Optional

Apple's ssh-add has a macOS-specific flag, --apple-use-keychain, that remembers passphrases so ssh-agent can load keys automatically.

Command
$ ssh-add --apple-use-keychain ~/.ssh/id_ed25519
▾ Undo
Undo
$ ssh-add -D && ssh-add --apple-use-keychain ~/.ssh/id_ed25519 (re-add without passphrase by regenerating the key)
Full explanation & undo →

Connect with ssh

This is the core step: macOS ships with an ssh client, so no installation is needed. Replace the username and address with your server's. It worked when you see the remote machine's welcome banner and your prompt changes to the remote shell.

macOSLog Into a Remote Machine with ssh on macOSMedium riskStep 4

Use the built-in ssh client to open a secure shell on another Mac, Linux box or server.

Command
$ ssh admin@192.168.1.20
Full explanation & undo →
!SSH gives you full control of the remote machine. Double-check the hostname and username before connecting, and only trust a host key fingerprint you received through a channel you trust.

How to confirm it worked

You're connected when your Terminal prompt becomes the remote machine's shell and you see its welcome banner; run a command like hostname there to confirm you're on the server.

Undo everything

Every command above can be reverted. Run these in order to undo all of it.

Undo everything
$ ssh-add -D && ssh-add --apple-use-keychain ~/.ssh/id_ed25519 (re-add without passphrase by regenerating the key)
sudo systemsetup -setremotelogin off

Review before running — some steps may not be independent.

Sources

  • systemsetup — set system settings (macOS man page)
    SS64 · technical · 2026-09-17
    Evidence: Documents -setremotelogin on|off, which enables or disables sshd-based Remote Login.
  • launchctl — interact with launchd (macOS man page)
    SS64 · technical · 2026-09-17
    Evidence: Background on launchd services such as sshd that Remote Login toggles.
  • SSH-KEYGEN(1) — OpenBSD manual
    OpenBSD · technical · 2026-09-17
    Evidence: Documents -l (fingerprint), -f (file) and reading from stdin with -.
  • ssh-add(1) — macOS man page
    Xcode Man Pages (mirror) · technical · 2026-09-17
    Evidence: Documents --apple-use-keychain: the passphrase is added to the keychain and later loaded automatically by ssh-agent.
  • ssh-add(1) — macOS man page
    manpagez · technical · 2026-09-17
    Evidence: Apple's ssh-add variant supports --apple-use-keychain (formerly -K) to persist passphrases in the macOS keychain.
  • ssh(1) man page
    Xcode Man Pages (keith.github.io) · technical · 2026-09-17
    Evidence: Man page for ssh: 'ssh [-46AaCfGgKkMNnqsTtVvXxYy] [-B bind_interface] [-b bind_address] [-c cipher_spec] … [-p port] destination [command]' with destination in user@hostname form.
  • ssh(1) - OpenSSH remote login client
    ManPagez · technical · 2026-09-17
    Evidence: Mirrors the ssh man page: ssh (SSH client) is a program for logging into a remote machine and executing commands, connecting as user@hostname.

Last verified: 2026-09-21