You want your home Mac to be an always-on machine you can SSH into from anywhere or from another computer. You install Tailscale, try to enable "Tailscale SSH" on the Mac, and get stuck. This post explains why that happens and walks you through a working setup, up to the point where you log in from your own device.
"Tailscale SSH" and "SSH over Tailscale" are different things
Let's separate the terms first.
- Tailscale SSH: a feature where Tailscale manages SSH authentication. Tailscale itself acts as the SSH server.
- Regular SSH over Tailscale: Tailscale only provides the network route. The SSH server is the OS's standard sshd, and you authenticate with your own SSH key.
Both mean you are SSHing over Tailscale, but they are configured differently and have different requirements. If your everyday Mac runs the GUI version of Tailscale, the second option, regular SSH, is the one you can use.
What happens when you enable Tailscale SSH on a Mac
If you have the Tailscale GUI app on your Mac (App Store or Standalone version) and try to enable Tailscale SSH, it stops with this error:
The Tailscale SSH server does not run in sandboxed Tailscale GUI builds.
In other words, the Tailscale SSH server doesn't run in the sandboxed GUI builds. You haven't misconfigured anything. This is by design.
Checking the official docs
Tailscale's macOS variants comparison table (in the official documentation) shows that the GUI versions, both App Store and Standalone, cannot act as a Tailscale SSH server. Only the open-source tailscaled can. The official docs do not recommend running tailscaled for desktop use.
So as long as your everyday Mac runs the GUI version of Tailscale, that Mac can't be a Tailscale SSH destination.
Source: the official Tailscale SSH docs, https://tailscale.com/docs/features/tailscale-ssh (the macOS variants comparison table is also part of the official documentation).
The fix: split the roles
Divide the responsibilities like this:
| Role | Handled by |
|---|---|
| Path | Tailscale (the GUI version is fine) |
| SSH server | macOS Remote Login (sshd) |
| Authentication | your own SSH key |
For the destination, use either a MagicDNS name (for example, my-mac.example.ts.net) or a Tailscale IP in the form 100.x.y.z. Tailscale provides a route that reaches the Mac without opening any ports, and regular SSH handles the authentication.
Prerequisites
The steps below assume two things:
- The client and the Mac are both on the same tailnet and can connect to each other.
- You know your MagicDNS name and Tailscale IP. You can find them in the Tailscale app menu on the Mac, or in the machine list in the admin console.
Prepare the Mac: Remote Login and SSH keys
Enable Remote Login
On the destination Mac, turn on macOS Remote Login (sshd). This makes the Mac a regular SSH server. Go to System Settings → General → Sharing and turn on Remote Login. It's safer to restrict access to just your own user.
Create a key and install the public key
On the client, create an SSH key:
ssh-keygen -t ed25519
You can place the public key on the Mac with ssh-copy-id. It works by connecting with password authentication and installing the public key. Run it in a regular terminal where you can type a password. In an environment without a terminal it can't answer the prompt and will fail.
ssh-copy-id -i ~/.ssh/id_ed25519.pub your-user@my-mac.example.ts.net
If ssh-copy-id isn't available, you can add the public key manually. Append the contents of the client's public key (~/.ssh/id_ed25519.pub) as a single line to ~/.ssh/authorized_keys on the Mac. If the file doesn't exist, create it, and make sure ~/.ssh is readable and writable only by you.
Add an SSH config entry and connect by name
Add this to ~/.ssh/config on the client. The host name and user name are examples.
Host home-mac
HostName my-mac.example.ts.net
User your-user
IdentityFile ~/.ssh/id_ed25519
HostName can be the MagicDNS name or a 100.x.y.z Tailscale IP. With this config, ssh home-mac is all you need to log in.
That completes the setup for logging in to your Mac from your own device. One thing to keep in mind: the Tailscale app must be running on the Mac, or the connection won't reach it.
Connecting from a long-running program or agent
Connecting from a long-running program or agent requires additional setup to keep it running without interruptions. That part is covered in the paid companion article, which is written in Japanese:
Originally published in Japanese on note. This English edition was translated and edited with AI assistance; all commands and facts are unchanged from the original.
Top comments (0)