In System Settings
- Open System Settings, General, Sharing. You may need to scroll down.
- Click the info button next to Remote Login.
- Switch Remote Login on.
- Under Allow access for, choose All users or Only these users. Prefer the short list.
- Note the command shown under "Remote Login: On". That is what you type on the other computer.
The Full Disk Access switch
The same panel has the option "Allow full disk access for remote users". Leave it off unless you need it. Without it, a remote session may get Operation not permitted in folders that macOS protects, even though you own them. That message is about this setting, not your Unix permissions.
From Terminal
sudo systemsetup -setremotelogin onAccording to man systemsetup this needs admin rights and Full Disk Access. Without the second, it stops with this message:
setremotelogin: Turning Remote Login on or off requires Full Disk Access privileges.To fix it, add your terminal app under System Settings, Privacy & Security, Full Disk Access, and open it again. Or use System Settings for this one change, which leaves your terminal without that broad permission.
To check the current state:
sudo systemsetup -getremoteloginWithout sudo it answers You need administrator access to run this tool... exiting!. Be careful with -setremotelogin off over SSH: the man page warns that you will then need local access to turn it back on.
Connect from another computer
ssh user@203.0.113.10Use the short account name, the one that whoami prints on the Mac, and the login password of that account. The name ending in .local shown in Sharing also works on the same network.
A Mac that is asleep does not answer. If the connection times out, wake the Mac and try again, or review its sleep settings.
Things that differ from Linux
- The port. launchd holds the listening socket, defined in
/System/Library/LaunchDaemons/ssh.plist, soPortinsshd_configdoes not decide where it listens. - The user list. The "Only these users" list is the group
com.apple.access_ssh. A user missing from it is refused even with the right password. - The configuration. The file is
/etc/ssh/sshd_config, with macOS's own settings in/etc/ssh/sshd_config.d/100-macos.conf.
Use a key
From the other computer, generate a key and install it with ssh-copy-id user@203.0.113.10. Then you can turn password login off. To reach the Mac from outside your network without opening a port on your router, see SSH without a public IP.
Keys and passwords for each machine can live in an SSH key manager with an encrypted vault instead of loose files.
Questions
Does turning on Remote Login expose my Mac to the internet?
Only if something forwards port 22 to it, such as a port forward on your router. On a normal home or office network, only devices on that network can reach it. Still use a strong password or a key.
How do I SSH into my Mac from an iPhone?
Turn on Remote Login, then open an SSH app on the iPhone and connect to the Mac's .local name or address with the Mac's user and password. Both devices must be on the same network, or on the same VPN when you are away.
How do I turn SSH off on a Mac?
Switch Remote Login off in System Settings, General, Sharing. Do it at the Mac itself, since turning it back on needs local access.