How AnyBucket uses your SSH setup

There's no separate key store to fill in. For SFTP, AnyBucket starts /usr/bin/ssh, the same program Terminal uses, so:

  • your private keys in ~/.ssh work,
  • keys loaded in your SSH agent work,
  • every Host block in ~/.ssh/config applies, including HostName, User, IdentityFile and ProxyJump,
  • host keys are checked against ~/.ssh/known_hosts, which Terminal shares.

The rule of thumb: if ssh user@host works in Terminal, it works in AnyBucket. Passwords, when a server asks for one, go to your login keychain.

Make a key and add it to the server

If you don't have a key yet:

  1. Open Terminal and run ssh-keygen -t ed25519. Press Return to keep the default file, ~/.ssh/id_ed25519, and choose a passphrase.
  2. Add the public half, ~/.ssh/id_ed25519.pub, to ~/.ssh/authorized_keys on the server, or send it to the server's administrator. Never share the file without .pub.
  3. Test it: ssh user@host should log in without asking for the server's password.

To avoid typing the passphrase every time, add the key to your agent with ssh-add. macOS can keep the passphrase in your keychain.

Name your servers in ~/.ssh/config

A Host block gives a server a short name and the settings to reach it:

Host staging
  HostName staging.example.com
  User deploy
  IdentityFile ~/.ssh/id_ed25519

Now ssh staging logs in as deploy with that key. In AnyBucket, connect to the server staging over SFTP and the same block applies, because AnyBucket passes the name to ssh just as Terminal would.

Reach a server through a jump host

Many servers can only be reached through a bastion, or jump host. In Terminal you'd write ssh -J bastion app for a one-off. To make it permanent, use ProxyJump:

Host bastion
  HostName bastion.example.com
  User me

Host app
  HostName 10.0.1.20
  User deploy
  ProxyJump bastion

Test with ssh app in Terminal. Once that logs in, connect AnyBucket to app over SFTP: the connection goes through the bastion by itself, with nothing extra to set in the app. Several jumps chain the same way, with a comma-separated list after ProxyJump.

Host keys: "isn't known yet" or "changed"

The first time you connect to a server, its key isn't in ~/.ssh/known_hosts yet, and AnyBucket asks before it trusts it, as Terminal does. Compare the fingerprint with the one your server's administrator published.

If AnyBucket says a key changed, stop and find out why. After a server is rebuilt or reinstalled, a new key is expected. Otherwise, don't connect: a changed key can mean you're not talking to the server you think. More in troubleshooting.

When it doesn't work

  1. Try Terminal first with exactly the host name you use in AnyBucket: ssh staging. If that fails, the problem is in the SSH setup, not the app.
  2. Add -v (ssh -v staging) to see which keys and config lines ssh tries.
  3. Check the agent with ssh-add -l: it lists the keys the agent holds.
  4. Check permissions: ssh refuses private keys that other users can read. chmod 600 ~/.ssh/id_ed25519 fixes that.

Still stuck? See SFTP keys or jump hosts don't work, or email support with what ssh -v shows, minus anything private.