Configuring SSH Client in macOS 13 Terminal

macOS 13 Ventura includes OpenSSH as its native command-line SSH client inside the Terminal application. This article covers the available SSH client configurations in macOS 13, including file locations, Host-based profiles, authentication directives, macOS-specific Keychain integrations, and keep-alive parameters to optimize your remote connections.

Configuration File Locations

The SSH client in macOS 13 reads configuration settings in a specific order of precedence:

  1. User Configuration (~/.ssh/config): Takes highest precedence and applies only to the current macOS user. This file does not exist by default and must be created manually with permissions set to 600.
  2. System-wide Configuration (/etc/ssh/ssh_config): Applies default behaviors to all users on the Mac. Modifying this requires administrative privileges (sudo).

Core Connection Directives

Within ~/.ssh/config, you can define global settings or configure aliases for specific remote servers using the Host block:

Host myserver
    HostName 192.0.2.1
    User admin
    Port 2222

Available core directives include:

  • Host: Defines the alias or pattern to match when executing the ssh command.
  • HostName: Specifies the actual IPv4, IPv6, or domain name of the remote system.
  • User: Sets the default username for the login session.
  • Port: Specifies an alternate port if the target server does not listen on standard port 22.

Authentication and Key Management

macOS 13 supports standard public-key cryptography (such as Ed25519 and ECDSA) along with Apple Keychain integration:

  • IdentityFile: Specifies the path to the user's private key (e.g., IdentityFile ~/.ssh/id_ed25519).
  • UseKeychain: A macOS-specific option that allows SSH to store private key passphrases directly in the Apple Keychain, eliminating repetitive passphrase prompts across restarts.
  • AddKeysToAgent: When set to yes, automatically loads the configured key into the running ssh-agent.
  • IdentitiesOnly: When set to yes, forces SSH to present only the keys explicitly defined in the configuration or on the command line, preventing authentication failures caused by offering too many keys.

Example implementation:

Host *
    AddKeysToAgent yes
    UseKeychain yes
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes

Legacy Cryptography Adjustments

Because macOS 13 uses newer builds of OpenSSH where the SHA-1 hash algorithm for RSA keys is disabled by default, older servers may reject modern RSA connections. You can re-enable legacy support for specific hosts using:

  • PubkeyAcceptedKeyTypes: Re-enables deprecated signature algorithms (e.g., PubkeyAcceptedKeyTypes +ssh-rsa).
  • HostKeyAlgorithms: Specifies accepted host key formats if connecting to legacy hardware.

Connection Stability and Proxying

To manage connection state and complex network topologies, the following configurations are available:

  • ServerAliveInterval: Sets a timeout interval in seconds. If no data is received from the server, the client sends a packet to keep the connection alive.
  • ServerAliveCountMax: Sets the number of unanswered server-alive messages before the client disconnects.
  • ProxyJump: Simplifies connections routed through a jump host or bastion server (e.g., ProxyJump bastion.example.com).
  • ForwardAgent: Specifies whether the connection to the authentication agent will be forwarded to the remote machine. This should be set to no by default for security.