--- title: "SSH keys and jump hosts for SFTP on a Mac" description: "Set up SSH keys, the agent, ~/.ssh/config and ProxyJump jump hosts on a Mac once, and use them for SFTP in Terminal and in AnyBucket alike." url: https://anybucket.app/guides/ssh-keys-and-jump-hosts lang: en --- # SSH keys and jump hosts, set up once Logging in with a key instead of a password, and reaching a server that sits behind a bastion host, both live in your Mac's own SSH setup. Get them working in Terminal, and SFTP in AnyBucket follows. ## The short answer AnyBucket runs the `ssh` that comes with macOS (`/usr/bin/ssh`), so it uses your keys, your SSH agent, your `~/.ssh/config` (`Host`, `IdentityFile`, `ProxyJump`) and security keys exactly as Terminal does. Set things up so that `ssh user@host` works in Terminal, then connect to the same host in AnyBucket. Host keys are checked against your own `~/.ssh/known_hosts`. ## How AnyBucket uses your SSH setup There's no separate key store to fill in. For SFTP, AnyBucket starts `/usr/bin/ssh`, the same program Terminal uses, so: - your private keys in `~/.ssh` work, - keys loaded in your SSH agent work, - every `Host` block in `~/.ssh/config` applies, including `HostName`, `User`, `IdentityFile` and `ProxyJump`, - host keys are checked against `~/.ssh/known_hosts`, which Terminal shares. The rule of thumb: **if `ssh user@host` works in Terminal, it works in AnyBucket.** Passwords, when a server asks for one, go to your login keychain. ## Make a key and add it to the server If you don't have a key yet: 1. Open Terminal and run `ssh-keygen -t ed25519`. Press Return to keep the default file, `~/.ssh/id_ed25519`, and choose a passphrase. 2. Add the public half, `~/.ssh/id_ed25519.pub`, to `~/.ssh/authorized_keys` on the server, or send it to the server's administrator. Never share the file without `.pub`. 3. Test it: `ssh user@host` should log in without asking for the server's password. To avoid typing the passphrase every time, add the key to your agent with `ssh-add`. macOS can keep the passphrase in your keychain. ## Name your servers in ~/.ssh/config A `Host` block gives a server a short name and the settings to reach it: ``` Host staging HostName staging.example.com User deploy IdentityFile ~/.ssh/id_ed25519 ``` Now `ssh staging` logs in as `deploy` with that key. In AnyBucket, connect to the server **staging** over SFTP and the same block applies, because AnyBucket passes the name to `ssh` just as Terminal would. ## Reach a server through a jump host Many servers can only be reached through a bastion, or jump host. In Terminal you'd write `ssh -J bastion app` for a one-off. To make it permanent, use `ProxyJump`: ``` Host bastion HostName bastion.example.com User me Host app HostName 10.0.1.20 User deploy ProxyJump bastion ``` Test with `ssh app` in Terminal. Once that logs in, connect AnyBucket to **app** over SFTP: the connection goes through the bastion by itself, with nothing extra to set in the app. Several jumps chain the same way, with a comma-separated list after `ProxyJump`. ## Host keys: "isn't known yet" or "changed" The first time you connect to a server, its key isn't in `~/.ssh/known_hosts` yet, and AnyBucket asks before it trusts it, as Terminal does. Compare the fingerprint with the one your server's administrator published. If AnyBucket says a key **changed**, stop and find out why. After a server is rebuilt or reinstalled, a new key is expected. Otherwise, don't connect: a changed key can mean you're not talking to the server you think. More in [troubleshooting](https://anybucket.app/support/troubleshooting#host-keys). ## When it doesn't work 1. **Try Terminal first** with exactly the host name you use in AnyBucket: `ssh staging`. If that fails, the problem is in the SSH setup, not the app. 2. **Add `-v`** (`ssh -v staging`) to see which keys and config lines `ssh` tries. 3. **Check the agent** with `ssh-add -l`: it lists the keys the agent holds. 4. **Check permissions:** `ssh` refuses private keys that other users can read. `chmod 600 ~/.ssh/id_ed25519` fixes that. Still stuck? See [SFTP keys or jump hosts don't work](https://anybucket.app/support/troubleshooting#ssh-keys), or email support with what `ssh -v` shows, minus anything private. ## Questions, answered ### Does AnyBucket read my ~/.ssh/config? Yes. It runs `/usr/bin/ssh`, which reads `~/.ssh/config` as it does in Terminal: `Host`, `HostName`, `User`, `IdentityFile`, `ProxyJump` and the rest. ### Where do I set up the jump host? In `~/.ssh/config`: put `ProxyJump` there, test it with `ssh` in Terminal, then connect AnyBucket to the final host's name. The jump happens by itself. ### Does it work with an SSH agent or a security key? Yes. An agent or a security key that works with `ssh` in Terminal works in AnyBucket too, because it's the same `ssh`. ### Where does AnyBucket keep SFTP passwords? In your login keychain, one item per bookmark. Keys stay where they are, in `~/.ssh`, and AnyBucket never copies them. ### Why does a server's key say “changed”? Its key no longer matches the one in `~/.ssh/known_hosts`. That's expected after a server is rebuilt; otherwise, don't connect until you know why. ## Read next - [SFTP](https://anybucket.app/features/sftp) - [SFTP on a Mac](https://anybucket.app/guides/sftp-client-mac) - [Troubleshooting](https://anybucket.app/support/troubleshooting) - [Compatibility](https://anybucket.app/support/compatibility) **Buy for $9.99:** https://buy.polar.sh/polar_cl_pCF9yOjezTUaUqMPyUsxEho1EjcOvo6Bk49Q929LQCQ --- AnyBucket is independent software by [Clever Mechanisms](https://clevermechanisms.dev). It is not affiliated with, endorsed by or sponsored by Apple Inc. or any storage provider. Independent software in the spirit of Cyberduck and the classic two-pane commanders. Not affiliated with iterate GmbH (Cyberduck). Apple, Mac, macOS, Finder and Quick Look are trademarks of Apple Inc., registered in the U.S. and other countries and regions. Amazon S3 is a trademark of Amazon.com, Inc. Other product names are trademarks of their owners. Email support: support@clevermechanisms.dev