← Documentation

SSH Sources

An SSH Server is a remote host you tail files on. Streams under an SSH Server Stream output from a single file on that host (via tail -F on a hidden SSH channel).

Creating one

+ ▸ 'New Source…' ▸ 'SSH Server'

The sheet asks for:

• Name - what shows in the sidebar.
• Icon - any SF Symbol.
• Host - hostname or IP. If you have an entry in ~/.ssh/config, click the chevron button next to the Host field to pick from your configured aliases.
• Port - leave blank for the standard port 22. Type a number to connect on a different one.
• User - the SSH user (auto-filled from ~/.ssh/config when you pick an alias or type a host that has a User directive).
• Auth - Auto-Detect, Private Key, or Password (see Authentication methods).
• Key - for Private Key auth, click Select… to pick your OpenSSH private key. The row then shows whether a key is configured; Clear removes it.

Then Test Connection verifies host reachability, auth, and that the remote shell answers a basic command. The result shows ✓ Connected or ✗ Test failed with specific detail.

Authentication methods

• Auto-Detect - LogRaker uses the same key ssh itself would. It takes an IdentityFile from a matching ~/.ssh/config entry when there is one, and otherwise tries the standard key names in ~/.ssh, in order: id_ed25519, id_ecdsa, id_rsa. A key stored under any other name (an Amazon EC2 .pem, for instance) is not picked up - select it with Private Key instead. Nothing is stored on the Server; each Mac uses whatever key it already has.
• Private Key - pick a private key file. The key (and its passphrase, if the key is encrypted) is stored securely in your keychain - the Server keeps the credential, not a copy of the file's path.
• Password - type the host's password. It's stored securely in your keychain, never in the Server's saved data.

Key formats

LogRaker reads Ed25519, ECDSA and RSA private keys. Both common file formats work: the OpenSSH format that ssh-keygen writes today, and the older PEM format that Amazon EC2 downloads as a .pem file. If the key has a passphrase, LogRaker asks for it when you pick the file.

Two kinds of key can't be used, and LogRaker tells you which one you hit:

• An RSA key smaller than 2048 bits. Too weak to rely on. Create a replacement key instead.
• A key protected with an older PEM passphrase scheme. Run ssh-keygen -p -f keyfile and give it the same passphrase. That rewrites the file in the current format, and the key keeps working everywhere you already use it.

Don't have a key yet? The SSH Key Manager (Tools menu) creates one and installs it on your server without opening Terminal - and after a deploy it offers to switch the server to key authentication for you.

Credentials and iCloud

Private Key and Password credentials follow you to your other Macs via iCloud Keychain - set a Server up once and it connects everywhere, with no need to re-pick the key file on each Mac. Each editor shows this with a small "syncs across your Macs via iCloud Keychain" note. If you later rotate or replace a key - even at the same path - re-pick it with Select… (or retype the password) to update the synced copy on all your Macs; editing other fields leaves the credential untouched.

Auto-Detect is not synced: it resolves a key from each Mac's own ~/.ssh at connect time, so every Mac needs its own key. The App Store edition has no Auto-Detect at all: a Server that reaches it with Auto-Detect set, synced from a Mac running the Web edition or restored from a configuration, asks you to set Auth to Private Key and select the key once. Its success panel says so: "Uses an SSH key found on each Mac - not synced." See iCloud Sync for the bigger picture.

The ~/.ssh/config picker

When ~/.ssh/config declares one or more Host aliases, the Host field gets a small chevron button next to it. Clicking opens a menu of every alias, formatted as "alias hostname" - the alias in primary text on the left, the resolved hostname in secondary text on the right.

Picking an alias from the menu writes the resolved hostname into the Host field (so the saved Server points at the actual host, not the alias), pre-fills the User field if the alias declared a User, and fills the Port field if it declared a Port.

The rest of that entry keeps applying too. With Auto-Detect authentication, an IdentityFile in the entry you picked is used when connecting, the same key ssh itself would use. Typing a hostname by hand instead uses whatever entry matches that hostname.

If ~/.ssh/config is missing or has no literal aliases (only glob patterns like Host *), the chevron button is hidden - the Host field is just a plain text field.

Port

The Port field sits beside Host in the Source sheet. Leave it blank and LogRaker connects on port 22.

A port you type here is always used, whichever authentication method the Source uses. When the field is blank and the Source uses Auto-Detect, a Port directive in a matching ~/.ssh/config entry is used instead.

Picking an alias from the chevron button next to Host fills the Port field in for you when that entry sets one.

Changing the port reconnects the Source. The server is trusted per port, so the first connection on a new port asks you to confirm its fingerprint again.

Trust ledger

The first time LogRaker connects to a host, the host's key isn't yet trusted. A sheet asks you to confirm before continuing - you can click View Fingerprint… to inspect the SHA-256 fingerprint before deciding. Approve once, and the host is added to LogRaker's trust ledger (separate from your shell's ~/.ssh/known_hosts).

If the remote host's key ever changes (legitimate rekey, server rebuild, MITM), LogRaker presents a two-step warning sheet on the next connect. You can replace the trusted key or refuse - refusing aborts the connection.

Decline a trust prompt and the Server keeps its place in the sidebar, marked with a red crossed-out padlock, and its Streams stop rather than asking again. Click Start on one of them to retry and get the prompt back.

Trusted hosts are listed under Settings ▸ Security. Remove a host there to drop its trust record and disconnect any open session to that host.

Connection management

One SSH parent connection per Server is shared across every Stream that targets it. A pool keeps the parent alive with TCP keepalives (15s idle / 15s probes / 3 retries ≈ 60s dead- socket detection) and an SSH-level ping every 30s. Reconnects use exponential backoff (3s → 6 → 12 → … → 60s), reset after a connection lives past a minute.

Local Network privacy

The first time LogRaker reaches a *.local Bonjour hostname or a local-network IP (192.168.x.x, 10.x.x.x, etc.), macOS presents the Local Network privacy prompt. Before you approve, the connection silently fails with something like "No route to host". After you approve, no further prompts.

If you see persistent "no route to host" / connection- refused errors on a .local host, see Troubleshooting.