What is SSH? What is SFTP?

I updated my Mac to 10.13.6 on and both my SSH and Sublime Text SFTP stopped working. (But my Cyberduck SFTP and Microsoft Remote Desktop continued to work.) Using the steps in the initial post didn’t work for me.

SSH / config grep “host” This article introduces the method of MAC using shell (terminal) SSH to connect to remote server. For more content about shell SSH connection to remote server, please search the previous articles of developeppaer or continue to browse the related articles below. I hope you can support developeppaer more in the future!
Feb 14, 2018 Now, you might want to verify whether the SSH server working as intended. Open a Terminal window and type in: ssh @localhost. This command will show you the server key and ask you to accept it. Type in “yes” to verify, and then type in your password. You’ll now be logged in to your Mac over SSH. Now, you can execute various.

SSH (Secure Shell Protocol) is a secure replacement for telnet. Like telnet, SSH can be used to connect to a remote host computer using an account name and password. The advantages of SSH over telnet are:

All information transmitted between your computer and the host is encrypted. This protects your password during login as well as information transmitted after logging in.
If available, you can use a publicly published 'fingerprint' for a host's 'key' to verify the host's identity.

Make a Connection to a Remote Host

Open Terminal in the Applications > Utilities folder.
Type ssh account_name@host_name in the terminal window, where account_name is your account name on the host and host_name is the host's full Internet name. Press the Return key. If you are connecting to apollo.sfsu.edu or libra.sfsu.edu then replace account_name with your SFSU email account name and replace host_name with either apollo.sfsu.edu or libra.sfsu.edu. For example, Jane Doe, with SFSU email account janedoe, would connect to host libra.sfsu.edu by typing:ssh janedoe@libra.sfsu.edu then pressing the Return key.
The first time you connect to a host you will see a message similar to:
The authenticity of host 'libra.sfsu.edu (130.212.10.238)' can't be established.
RSA key fingerprint is 57:fe:4b:78:94:1e:8c:3d:28:ce:67:40:85:fe:24:85.
Are you sure you want to continue connecting (yes/no)?
- Verify the host matches one of the following:
  - online.sfsu.edu - updated 11/25/08
    - 06:4e:57:ee:f5:c8:e7:c7:99:9a:e9:5f:95:88:53:a1
      xunil-novip-mafuh-moduc-tunuk-dulyb-symen-hebim-tacec-kypiz-nyxax
  - www.sfsu.edu - updated 11/25/08
    - 73:c2:09:ec:f5:8a:a2:cf:d8:4e:34:bd:24:1f:b3:66
      xepop-cigab-vokyd-tipyh-vadaf-sidez-cunat-sylol-befug-sikyf-rixex
    - a4:bd:6f:3c:61:5b:15:7b:da:ef:7f:1c:27:2a:8a:b2
      xonob-likem-tunyg-semon-nogeb-bukag-hucos-zyzyg-mecih-zuvoh-lexix
- - If the fingerprints do NOT match, click the Cancel button to cancel your connection. Submit a Service Request. Mismatched fingerprints might mean that your connection has been compromised.
  - If the fingerprints DO match, type yes then press the Return key. You will see a message similar to:
    Warning: Permanently added 'libra.sfsu.edu,130.212.10.238' (RSA) to the list of known hosts.
Type your password when prompted then press the Return key.
Use the resulting SSH session the same way you would use a telnet session.
When you are finished exit your SSH session, close your terminal window, then close Terminal.

What if the Fingerprints Matched Originally but They Don't Now?

Using the SSH client built in to Mac OS X you will you get a message similar to the following:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is 57:fe:4b:78:94:1e:8c:3d:28:ce:67:40:85:fe:24:85.
Please contact your system administrator.
Add correct host key in /Users/janedoe/.ssh/known_hosts to get rid of this message.
Offending key in /Users/janedoe/.ssh/known_hosts:1
RSA host key for libra.sfsu.edu has changed and you have requested strict checking.
Host key verification failed.

This either means that the host has a new key and the fingerprint has changed or that you are the victim of a man-in-the-middle exploit. In order to protect you, the Mac OS X SSH client will not let you complete the connection to this host until the old key is removed from your computer. If you determine that the host's key has been changed (see connection instructions for current keys), follow these steps to remove the old key:

Open Terminal in the Applications > Utilities folder.
Type open .ssh in the terminal window then press the Return key. This opens the .ssh folder which contains the file known_hosts.
Drag known_hosts into the trash then close the .ssh folder.
Close Terminal.

Deleting known_hosts removes all host keys from your computer so all hosts you connect to will be treated as though you are connecting to them for the first time.

The SSH configuration file on your Mac controls how secure shell, aka SSH, operates. It can be used for simple alternations, like changing the ssh port on your devices, can often eliminate a huge number of ssh “cold calls” on your machine, the ssh configuration file can do much more than that.

Where is the SSH configuration file?

Putty Download

On macOS systems, the configuration file is found at “/private/etc/ssh/ssh_config,” which is symlinked to “/etc/ssh/ssh_config” for compatibility.

A second, user-specific ssh_config is found at “~/.ssh/ssh_config.” If it exists, this file supersedes the system-wide configuration file. This file sets user-specific options without changing the system’s configuration.

Going forward, we will refer to this configuration file as “ssh_config” for clarity and simplicity. You can edit whichever one is better suited to your purposes.

What is the ssh_config file and what does ssh_config do?

The ssh_config file is used to control how secure shell, better known as the ssh terminal command, operates on your system. The ssh configuration file is organized by hosts. Each host contains specific settings for that host. Wildcards like * can be used to match multiple hostnames with a single declaration.

Options are declared using a key/definition pair. A detailed explanation of each key’s functionality can be found on the ssh_config man page. We will cover the most relevant collection of changes below.

Editing the ssh_config file

To edit the ssh_config file, open a Terminal window and edit the file with your preferred text editor. We will use nano in this demo, but vi or emacs can be used instead.

Hardening your SSH configuration

Ssh For Mac Osx

Confirm SSH Protocol 2

By default, SSH should use Protocol 2, the more secure protocol. The older protocol, aptly named Protocol 1, works with a weaker integrity check and is generally less secure.

However, older systems may request Protocol 1. To explicitly set the stronger protocol, use the following in your ssh_config:

You can also implicitly set your protocol by using Ciphers. This will automatically set Protocol to 2.

Disallow empty password

This key bans logging in to the ssh system without using a password, effectively requiring all users to set passwords. Change AllowEmptyPassword to No.

Ssh For Mac Terminal Linux

Disallow root login

Prohibiting root login will dramatically reduce the damage that an attacker can do to your system. However, it might make your job a little harder, depending on what you need to do. Options for PermitRootLogin include “yes,” “without-password,” “forced-commands-only,” or “no.” The default is “yes.”

Change the ssh port number

Changing the port used by ssh can help you avoid simple attacks on your server. While this won’t work against an atta