How to connect your Mac to a server with SSH

Gather the details before opening a client

Ask the administrator for the exact login account and port rather than assuming a web-dashboard login works over SSH. If the service is private, establish the required VPN or approved network access first.

• Server hostname or IP address, provided through a trusted channel.
• SSH port; 22 is common but not guaranteed.
• Remote username and the approved password or private key.
• Expected server host-key fingerprint and any bastion or MFA requirements.

Try a direct connection in Terminal

The following example uses a documentation hostname and a placeholder account. Replace them with the details your administrator supplied. The second example uses a non-default port.

ssh user@server.example.com
ssh -p 2222 user@server.example.com

Use a private key when your administrator requires it

A private key identifies you; a server host key identifies the server. Keep your private key on your Mac and do not paste it into chat, a ticket or a public repository. Supply the key file to your client and enter its passphrase when prompted.

OpenSSH documents the -i identity-file and -p port options: https://man.openbsd.org/ssh

ssh -i ~/.ssh/id_ed25519 -p 2222 user@server.example.com

Verify the server, then verify your session

On a first connection, compare the displayed host fingerprint with the independently supplied value. If it differs, stop and check with the administrator. A changed fingerprint can be legitimate after a rebuild, but should not be dismissed automatically.

After login, use harmless checks such as whoami and pwd. Confirm the account and location before running changes. Seeing a prompt proves a shell opened; it does not prove you have permission for every directory or service.

Save the connection in Docklark

In Docklark, open connection management and create a connection using the same host, port, account and authentication details. Give it a specific name such as “Staging web” so future sessions are easy to identify.

Direct SSH is a documented Docklark connection workflow. If your organization uses JumpServer, follow the separate JumpServer preparation guide rather than treating a web portal URL as an SSH endpoint. See /docs/ssh/ and /docs/jumpserver/.

If it fails, classify the error first

A timeout points toward reachability; a refusal often means the address or port is reachable but the service is unavailable there; an authentication rejection needs account or key checks. Changing clients cannot fix a missing VPN route or a server-side access policy.

Use the troubleshooting guide for the next checks instead of repeatedly trying unrelated passwords.

Frequently asked questions