← Documentation

SSH Key Manager

The SSH Key Manager (Tools ▸ SSH Key Manager) creates SSH key pairs and installs them on your servers - the whole ssh-keygen + ssh-copy-id routine without opening Terminal. Use it to move a server from password sign-in to passwordless key authentication in a couple of clicks.

The window has two panes: your stored keys on the left, and details for the selected key on the right - its public key (copyable), SHA-256 fingerprint, and a history of the servers it has been deployed to.

Creating a key

Click Create Key in the toolbar. The sheet asks only for a name (pre-filled with LogRaker @ your Mac's name); the algorithm is Ed25519, the modern OpenSSH default.

The private key is stored in the macOS Keychain and syncs to your other Macs via iCloud Keychain - it is never written to disk unless you export it. The key list itself (names, public keys, deployment history) syncs with the rest of your LogRaker data via iCloud.

Deploying to a server

Select a key and click Deploy. Pick one of your SSH Sources from the popup - hostname and username fill in automatically, and LogRaker signs in with whatever already works, the same way ssh-copy-id does: the server's existing key (the one your streams connect with), a stored password, or a password you type. If the server can already stream, you usually don't type anything. Pick Other… instead to enter a hostname, username, and password for a machine you haven't added to LogRaker. Test Connection checks the sign-in before you commit.

Once connected, LogRaker appends the public key to the account's ~/.ssh/authorized_keys (creating the file with correct permissions if needed), then verifies by reconnecting with the new key before reporting success. A typed password is used only for that one connection and is not stored. Deploying the same key to the same server again is harmless - the install step skips keys that are already present.

Already have SSH key access? Deploy still makes sense

A server's authorized_keys is a list - each line is a key, and any of them signs you in. Deploying adds the managed key as an additional line; keys that already work (say, the ~/.ssh/id_ed25519 this Mac was already using) keep working, and streaming is untouched. The difference: a key file in ~/.ssh exists on one Mac only, while a managed key syncs to your other Macs via iCloud Keychain and can be removed from the server again from inside LogRaker. Removing the managed key later deletes only its own line - your original access stays.

If the server hasn't been trusted before, the usual first-contact trust prompt appears - see Trust ledger.

Switching a server to the key

After a successful deploy to one of your SSH Sources, LogRaker offers to switch that server to key authentication using the freshly installed key. Accept, and LogRaker connects with the key from then on - no key file to pick, the credential lives in your keychain. The server editor's Key row shows the key by name ("Using SSH key … from the SSH Key Manager").

Whatever the server used before - a password, an auto-detected key, or another key - is remembered: removing the key from the server switches back to it automatically, and you can change the server's authentication in its editor at any time.

Exporting a key

Export writes the selected key as a standard OpenSSH key pair - the private key file (with the 600 permissions ssh requires) and its .pub companion - into a folder you choose, defaulting to ~/.ssh/. Use this when another program needs the key, or as a backup. The exported file has no passphrase; add one with ssh-keygen -p if you want it protected. (For just the public line, Copy Public Key puts the authorized_keys entry on the clipboard.)

Removing a key from a server

Each entry in the Deployments list has a Remove… button. LogRaker connects to that server - using the key itself, or the server's stored password - deletes the key's line from ~/.ssh/authorized_keys, and verifies the key no longer signs in before forgetting the entry.

If the matching server was switched to this key when it was deployed, removal restores whatever the server used before - its previous key, stored password, or auto-detect - so streaming keeps working. (If you reconfigured the server yourself in the meantime, removal leaves your configuration alone.)

If the server is unreachable (offline, decommissioned), the failure message offers Remove from List Anyway, which forgets the entry without touching the server.

Deleting a key

A key can only be deleted after it has been removed from every server in its Deployments list - so no forgotten public keys linger in authorized_keys files. Once the list is empty, Delete removes the key; the private key is removed from your keychain when you quit LogRaker (so Undo can bring it back until then).

On your other Macs

A key created on one Mac appears in the SSH Key Manager on your other Macs. If the private half hasn't arrived yet (iCloud Keychain still syncing, or turned off), the key shows a warning and Deploy / Export are unavailable until it does. Create, rename, and delete all support Undo.