SSH Sources

An SSH Server is a remote host you tail files on. Streams under an SSH Server stream output from a single file on that host (via tail -F on a hidden SSH channel).

Creating one

+ ▸ New SSH Server…

The sheet asks for:

Name - what shows in the sidebar.
Icon - any SF Symbol.
Host - hostname or IP. If you have an entry in ~/.ssh/config, click the chevron button next to the Host field to pick from your configured aliases.
User - the SSH user (auto-filled from ~/.ssh/config when you pick an alias or type a host that has a User directive).
Auth - Auto-Detect, Private Key, or Password (see Authentication methods).
Key - for Private Key auth, click Select… to pick your OpenSSH private key. The row then shows whether a key is configured; Clear removes it.

Then Test Connection verifies host reachability, auth, and that the remote shell answers a basic command. The result shows ✓ Connected or ✗ Test failed with specific detail.

Authentication methods

Auto-Detect - LogRaker looks for a usable key in this Mac's ~/.ssh at connect time, honoring any matching ~/.ssh/config entry. Nothing is stored on the Server; each Mac uses whatever key it already has.
Private Key - pick an OpenSSH private key file. The key (and its passphrase, if the key is encrypted) is stored securely in your keychain - the Server keeps the credential, not a copy of the file's path.
Password - type the host's password. It's stored securely in your keychain, never in the Server's saved data.

Don't have a key yet? The SSH Key Manager (Tools menu) creates one and installs it on your server without opening Terminal - and after a deploy it offers to switch the server to key authentication for you.

Credentials and iCloud

Private Key and Password credentials follow you to your other Macs via iCloud Keychain - set a Server up once and it connects everywhere, with no need to re-pick the key file on each Mac. Each editor shows this with a small "syncs across your Macs via iCloud Keychain" note. If you later rotate or replace a key - even at the same path - re-pick it with Select… (or retype the password) to update the synced copy on all your Macs; editing other fields leaves the credential untouched.

Auto-Detect is not synced: it resolves a key from each Mac's own ~/.ssh at connect time, so every Mac needs its own key. Its success panel says so: "Uses an SSH key found on each Mac - not synced." See iCloud Sync for the bigger picture.

The `~/.ssh/config` picker

When ~/.ssh/config declares one or more Host aliases, the Host field gets a small chevron button next to it. Clicking opens a menu of every alias, formatted as "alias hostname" - the alias in primary text on the left, the resolved hostname in secondary text on the right.

Picking an alias from the menu writes the resolved hostname into the Host field (so the saved Server points at the actual host, not the alias) and pre-fills the User field if the alias declared a User.

If ~/.ssh/config is missing or has no literal aliases (only glob patterns like Host *), the chevron button is hidden - the Host field is just a plain text field.

Trust ledger

The first time LogRaker connects to a host, the host's key isn't yet trusted. A sheet asks you to confirm before continuing - you can click View Fingerprint… to inspect the SHA-256 fingerprint before deciding. Approve once, and the host is added to LogRaker's trust ledger (separate from your shell's ~/.ssh/known_hosts).

If the remote host's key ever changes (legitimate rekey, server rebuild, MITM), LogRaker presents a two-step warning sheet on the next connect. You can replace the trusted key or refuse - refusing aborts the connection.

Trusted hosts are listed under Settings ▸ Security. Remove a host there to drop its trust record and disconnect any open session to that host.

Connection management

One SSH parent connection per Server is shared across every stream that targets it. A pool keeps the parent alive with TCP keepalives (15s idle / 15s probes / 3 retries ≈ 60s dead- socket detection) and an SSH-level ping every 30s. Reconnects use exponential backoff (3s → 6 → 12 → … → 60s), reset after a connection lives past a minute.

Local Network privacy

The first time LogRaker reaches a *.local Bonjour hostname or a local-network IP (192.168.x.x, 10.x.x.x, etc.), macOS presents the Local Network privacy prompt. Before you approve, the connection silently fails with something like "No route to host". After you approve, no further prompts.

If you see persistent "no route to host" / connection- refused errors on a .local host, see Troubleshooting.