Practical workflows · Free tools · macOS
SSH guides and tools for Mac
Using a bastion? Check both jump-host endpoints with an isolated OpenSSH example, then save the verified route.
Choose the server task you need to finish. These guides explain the steps, what to check, and when Nexus Shell fits. Read them without signing in; the SSH tunnel command builder runs in your browser.
Nexus Shell requires Apple Silicon and macOS 14.2+. Personal, non-commercial SSH use has a free tier; SFTP, Docker management and monitoring are Pro features. Review current pricing and trial terms before choosing a workflow for work.
Start your first Nexus Shell session
For the website or Homebrew edition, open Membership in the app, choose Sign In, finish the app-initiated browser flow and check the account and trial status back in the app. Signing in only on the website does not establish an app session. Eligible trial time does not restart on reinstall. App Store users use Apple's purchase and restore flow instead.
Follow the first-session checklist or read the Chinese instructions, then verify one authorized, non-critical server task before deciding on Pro. The checklist also explains what to check if the app remains signed out or shows a stale plan.
Check terminal symbols and input methods
Do Shift symbols such as * : ~ ! sometimes need two presses with a Chinese or Japanese input method active? The website / Homebrew v1.7.14 release fixes this specific issue. Check your version, compare dummy text locally, and separate keyboard layout, password echo and pasted text before changing server settings.
Check terminal input · 中文 · 日本語. App Store users should check Apple's update availability; this release note does not establish the Store version.
Fix a Mac SSH connection that cannot reach the server
Terminal reaches the server but your SSH app times out? Check app-specific outbound rules, separately from macOS Local Network permission. For browser sign-in that never completes in the app, use the account connection checklist.
For NAS and homelab connections: separate app Local Network permission from hostname, route, port and SSH authentication failures. Pick the observed symptom and compare Apple Terminal with your SSH app, without uploading server details.
Open the Mac SSH connection checklist
Tailscale is online but SSH still fails? Separate tailnet reachability, the SSH port and access policy. If the peer works by IP but not by name, check Mac MagicDNS through the system resolver before changing credentials.
Already reaching the server but seeing “Too many authentication failures”? Check SSH key selection, including overlapping config rules and the boundary between external agents and a GUI client's saved keys.
Seeing “kex_exchange_identification: Connection closed” or “reset by peer”? Check the SSH identification stage before resetting keys or network permissions. The credential-free loopback rehearsal separates accepted TCP, an SSH version line and a completed login.
Verify an SSH server fingerprint change
After a VPS rebuild, IP reuse or a hostname routing change, verify the endpoint and an independent fingerprint before updating saved trust. Find the exact host and port, preserve other servers' records, and understand the Nexus Shell prompt.
Follow the host-key change checklist and offline rehearsal
Already ran ssh-keygen -R but still see the warning? Check the exact port, HostKeyAlias and trust file. A successful exit can still mean “not found”; the isolated file-selection rehearsal shows why.
Keep a server job running after Mac sleep or an SSH disconnect
Start a remote tmux session before a long build, export or maintenance task. Rehearse with a harmless counter, detach, reconnect and inspect the original job before starting another copy. Local tunnels and Mac-to-server transfers need a different recovery step.
Open the remote job continuity guide
Returning to an existing session? Build the exact tmux return command locally, including switching clients when already inside tmux. Inspect first; do not restart another backup or build by mistake.
Already enabled keepalive but still getting logged out? Separate SSH peer checks, Bash idle logout and channel inactivity, then inspect the old job before retrying.
Edit a remote configuration file
Use this when you need to change one file on a server without losing a newer remote version. Follow the download, edit, compare and upload sequence, with permission checks and conflict handling.
Can read the file but cannot save it? Check SFTP write and directory permissions before retrying an upload, including a reproducible local experiment.
SSH works, but SFTP closes before files appear? Separate EOF, subsystem failure and a large-packet error, with five credential-free local startup results. Authentication success is not a file-listing or write-permission check.
Find a WinSCP alternative for Mac
Does rz/sz show protocol text, no file dialog, or stall in tmux? Check ZMODEM versus SFTP and the actual remote shell. Terminal-side support, server packages and interactive jump routes are separate checks; native trzsz relay is not implied.
Saved in your local editor but the server is unchanged? Check the temporary copy, upload outcome and active service path. A saved document is not proof of a completed upload.
Moving a file-transfer workflow from Windows? Compare visual SFTP clients and terminal options, then check the connection details you need to migrate. There is no documented automatic WinSCP session importer in Nexus Shell.
Before transferring real files, download the free SFTP test files and check a round trip: spaces, Chinese text, hidden and empty files, plus a byte-level checksum. Works with any SFTP client.
After downloading the test files back to a separate folder, use the same page's browser-local checker to find missing or changed files without a terminal command. It checks fixed original values; test file contents and hashes are not uploaded by the checker.
Moving from WinSCP text mode, or seeing a script's CRLF error? Compare your original and downloaded copy locally, with SHA-256 and a CRLF/LF-only difference check. No account or upload; two files up to 16 MiB each. Keep intentional line-ending conversion separate from byte integrity.
Resumed SFTP transfer has the right size but wrong contents? Check the partial copy and source version before another retry. Six local OpenSSH cases show why a successful resume is not a byte-integrity check; Nexus GUI resume support is not implied.
Two Linux files become one after downloading to the Mac? Check case-only filename collisions on the actual destination before retrying or overwriting. Four local filesystem cases show the difference between one unchanged file size and two retained copies; this is separate from SFTP protocol or Unicode compatibility.
Already have a saved Windows connection? Check SFTP versus FTPS, PuTTY keys and your first file task before moving it to your Mac.
Need a file from server A on server B? Check the two-server file workflow and path shortcuts, including what dual-pane Files and session tabs actually provide.
Using version 1.7.8? Click the path bar's empty area to type a directory; the pencil now follows the path. The checklist distinguishes this from older versions and from clicking a named directory to navigate.
Investigate a remote Docker container
CPU above 100%, or container memory showing the host's total? Compare the CPU denominator, cgroup limits and sampling scope, with offline examples distinguishing usage, pressure and throttling. Check website v1.8.0 versus the installed Store build before attributing a reading to the app.
Terminal lists containers but the Mac Docker view is empty? Compare the SSH account, Docker context and rootless endpoint before restarting or assuming containers disappeared.
Start with container state, bounded logs and host resources. The guide includes an isolated configuration-failure example and explains which tasks run on the Linux server, without requiring Docker Desktop on your Mac for that SSH workflow.
Follow the Docker troubleshooting workflow
Seeing “no space left on device”? Use the Docker disk-space checklist to separate bytes, inodes and guest storage before choosing a cleanup or capacity change.
Connect to a private database or web service
Generate a local SSH forwarding command for PostgreSQL, MySQL, Redis or a private web app. See which address belongs to your Mac and which is resolved by the SSH server. No registration is needed; form values stay in the page.
Tunnel started but the service still fails? Choose the observed error in the builder for a local listener check and the next service check. SSH setup, destination availability and service authentication are separate checks.
Run a first server check with an agent
Set up a saved test connection, approve Claude Code or Codex, and copy a bounded uptime and disk-check task. Check the visible result and understand the remote account's permissions before giving the agent more work.
Deploy an SSH workspace to managed Macs
For Mac administrators: review the official AutoPkg and Munki recipes, signing checks and test-catalog workflow. Confirm commercial licensing separately before deploying to a team.
Continue when VS Code Remote-SSH stalls
If an ordinary SSH session works but the remote editor cannot start, separate login problems from editor-server requirements. Use the diagnostic checklist and SSH/SFTP fallback for a small server task; it does not replace remote debugging or IDE features.
Writing about Nexus Shell
Find original screenshots with their captured version, the app icon, bilingual product facts, promotional video and review starting points. Compare website and App Store terms before describing a purchase option.