Why SSH aliases help

A full SSH destination can contain a host name, user, port, identity file and several connection options. Typing those values repeatedly is slow and makes mistakes more likely. OpenSSH already includes a durable place to describe destinations: the per-user configuration file at ~/.ssh/config.

A Host entry gives a destination a short local name. The alias can then be reused by other OpenSSH-based commands, so the value is larger than saving a few characters in ssh alone. The same configuration can make scp, sftp and rsync commands easier to read and maintain.

Create ~/.ssh/config safely

The .ssh directory and config file belong to your macOS user. If the file does not exist, create it with restrictive permissions. OpenSSH may reject files that are writable by other users. A common setup keeps the directory readable only by its owner and the configuration file owner-readable and owner-writable.

Back up an existing configuration before making broad changes. Keep one purpose per Host block, use comments for context, and avoid placing passwords in the file. The configuration is for connection settings, not secret storage.

mkdir -p ~/.ssh
chmod 700 ~/.ssh
touch ~/.ssh/config
chmod 600 ~/.ssh/config

Understand Host, HostName, User and Port

Host is the local pattern or alias you type. HostName is the real DNS name or IP address OpenSSH connects to. User sets the default remote account, and Port changes the destination port when it is not the standard SSH port. Indentation is optional but makes each block easier to scan.

Choose aliases that communicate environment and role, such as prod-web or lab-build, rather than vague names like server1. Avoid putting a sensitive value into an alias because aliases can appear in terminal history and logs.

Host prod-web
  HostName web.internal.example
  User deploy
  Port 22

Host lab-build
  HostName 192.0.2.40
  User builder
  Port 2222

Reuse aliases across commands

After saving the configuration, the alias becomes a destination understood by OpenSSH clients. ssh can open an interactive session. scp can copy files, sftp can start a file-transfer session, and rsync can use SSH as its transport. The command still controls its own source, destination and operation; the alias supplies connection defaults.

Test the alias with a low-risk connection before using it in an automated copy or deployment command. OpenSSH’s verbose mode can show which configuration values were selected when a destination does not behave as expected.

ssh prod-web
scp ./release.zip prod-web:/srv/releases/
sftp lab-build
rsync -av ./site/ prod-web:/var/www/site/

Manage patterns and precedence

Host may contain patterns, which are useful for defaults shared by a group. OpenSSH uses the first value obtained for many parameters, so put specific blocks before broad wildcard defaults. Test changes with ssh -G followed by an alias to inspect the resolved configuration without starting a normal session.

Keep aliases stable when scripts depend on them. If a host is retired, remove or clearly rename its entry rather than silently pointing a trusted alias at an unrelated machine. For a large estate, generate documented configuration through an approved management system instead of letting unreviewed copies diverge.

Host prod-*
  User deploy
  ServerAliveInterval 30

Host *
  AddKeysToAgent yes

Keep credentials secure

Prefer key-based authentication where the server policy supports it, protect private keys with appropriate permissions and a passphrase, and verify host keys instead of accepting unexpected changes. Never paste a password into ~/.ssh/config, a shell alias, a script or a shared dotfiles repository.

If an environment still requires passwords, use macOS Keychain or a reputable password manager and require local authentication before filling. Limit terminal history exposure, do not copy secrets into issue reports, and rotate a credential if it may have been disclosed.

Aliases improve usability but do not grant authority. They should point only to systems covered by your account and your organization’s access policy. A memorable alias is not a substitute for least privilege, change review or server-side auditing.

Where NMPWD fits

Native OpenSSH configuration is the right foundation for many workflows. NMPWD complements that foundation for macOS users who want a host book, alias completion and authentication assistance while continuing to type normal ssh, scp, sftp and rsync commands.

Its role is convenience around authorized terminal work, not a replacement for OpenSSH policy or server security. Review how it stores connection details, which password managers it supports and how Mac authentication is requested before adding it to a managed workflow.