--- title: SSH into a closed MacBook with Tailscale and tmux description: A closed MacBook sleeps and stops answering SSH. Use Remote Login, Tailscale and tmux, and keep the Mac awake with a Keep Mac Awake session. date: 2026-10-20 kicker: SSH section: Agents and remote control related: steer-ai-agents-from-your-phone, claude-code-remote-control-lid-closed, run-ai-agents-overnight-macbook order: 8 --- > **Short answer:** You can SSH into a MacBook with the lid closed only while it is awake, and closing the lid puts it to sleep. Turn on Remote Login, reach the Mac over Tailscale from a phone terminal app such as Termius, and run Claude Code or the Codex CLI inside tmux so it survives a dropped connection. Then keep the closed Mac awake: with an external display, with `pmset`, or with a Keep Mac Awake session you start on the Mac before you leave. ## Why can't I SSH into my MacBook when the lid is closed? Closing the lid puts a MacBook to sleep, and a sleeping Mac does not answer SSH. Apple lists "On a Mac laptop, close the display" as a way to put a Mac to sleep ([Apple Support](https://support.apple.com/guide/mac-help/put-your-mac-to-sleep-or-wake-it-mh10330/mac)). From an OpenSSH client, a Mac that cannot be reached ends in `ssh: connect to host my-mac port 22: Operation timed out`. `Connection refused` is different: the Mac answered, but nothing accepted connections on port 22, for example because Remote Login is off. tmux keeps a program running when your connection drops. It cannot keep it running while the Mac sleeps. You need both parts: a way in, and a Mac that stays awake. ## How do I turn on Remote Login on a Mac? Remote Login is the Mac's built-in SSH server; you turn it on in **System Settings > General > Sharing**. Apple's steps ([Apple Support](https://support.apple.com/guide/mac-help/allow-a-remote-computer-to-access-your-mac-mchlp1066/mac)): 1. Choose Apple menu > System Settings, click General, then Sharing. 2. Click the Info button next to Remote Login and turn on Remote Login. 3. Under "Allow access for", choose "Only these users" and add your own account. 4. Leave "Allow full disk access for remote users" off unless you need it. 5. Note the SSH command shown below "Remote Login: On". The format is `ssh username@hostname`. Apple also warns: "Allowing remote login to your Mac can make it less secure." The security section below covers that. ## How do I reach the Mac from my phone with Tailscale? Install Tailscale on the Mac and on the phone, sign in to the same tailnet, and connect to the Mac's Tailscale name. - **Install.** Tailscale for macOS needs macOS 12 or later ([macOS](https://tailscale.com/docs/install/mac)); there are apps for [iOS](https://tailscale.com/docs/install/ios) and [Android](https://tailscale.com/docs/install/android). - **Names.** With MagicDNS, devices in your tailnet reach each other by machine name, as in `ssh username@monitoring` ([MagicDNS](https://tailscale.com/docs/features/magicdns)). Each device also gets a 100.x address, and "Tailscale IP addresses aren't exposed to the public internet" ([IP addresses](https://tailscale.com/docs/concepts/tailscale-ip-addresses)). - **Use Remote Login, not Tailscale SSH.** As of October 2026, only the open-source `tailscaled` variant on macOS can be a Tailscale SSH server; the App Store and Standalone apps cannot ([macOS variants](https://tailscale.com/docs/concepts/macos-variants)). With those apps, connect to the Mac's own Remote Login over the tailnet. - **Key expiry.** Device keys expire after 180 days by default, and then "connections to/from the given endpoint will stop working". Tailscale suggests disabling expiry for devices such as trusted servers ([key expiry](https://tailscale.com/docs/features/access-control/key-expiry)). Another VPN you control works the same way; this guide uses Tailscale. ## How do I connect from a phone terminal app? Use any SSH app on the phone, for example Termius, with a key instead of a password. As of October 2026, Termius runs on iOS, Android and desktop; you generate a key under Keychain and export its public key to a host ([Termius docs](https://docs.termius.com/keychain/ssh-keys-and-certificates)). Add a host with the Mac's Tailscale name and your macOS account name. From a computer, the same connection is: ```sh ssh you@my-mac # "my-mac" is the Mac's MagicDNS name in your tailnet ``` ## How do I keep Claude Code running when the SSH connection drops? Run the agent inside tmux on the Mac. tmux keeps the session and its programs running after you detach or lose the connection, and you reattach later from any device. Install it with Homebrew (`brew install tmux`) or MacPorts ([tmux wiki](https://github.com/tmux/tmux/wiki/Installing)), then ([Getting Started](https://github.com/tmux/tmux/wiki/Getting-Started)): ```sh tmux new -s agent # start a session named "agent", then run claude or codex in it # press Ctrl-b, then d, to detach and leave it running tmux ls # list sessions tmux attach -t agent # reattach, for example from your phone ``` Anthropic's Claude Code docs give the same advice as of October 2026: "If you run `claude` from a terminal on a remote machine, start it inside `tmux` or `screen` to keep the session running after you disconnect from SSH" ([Remote Control](https://code.claude.com/docs/en/remote-control)). If you only need Claude Code, its Remote Control works without SSH; see [Claude Code Remote Control with the lid closed](/blog/claude-code-remote-control-lid-closed). ## How do I keep the MacBook awake with the lid closed? Start a Keep Mac Awake session on the Mac itself before you close the lid and leave; it keeps a MacBook awake with the lid closed and no external display. Free alternatives: an external display with power, keyboard and mouse ([Apple Support](https://support.apple.com/en-us/102501)), or `sudo pmset disablesleep 1`, which stays on until you undo it ([what pmset disablesleep does](/blog/pmset-disablesleep)). `caffeinate` does not stop lid-close sleep ([why](/blog/caffeinate-lid-closed)). Start the session at the Mac, from the menu bar or Terminal. The command-line reference says use of `keepmacawake` over SSH as the logged-in user "has not been verified yet", and that a call from a user who is not at the console cannot start a session ([command line](https://keepmacawake.com/command-line.md)). So do not plan on starting it from your phone. ```sh keepmacawake start --hours 8 # run on the Mac before you leave; 1 to 168 hours, or --unlimited keepmacawake status # shows the session ``` Stay logged in on the Mac: the session belongs to the user at the console, and logging out or switching users ends it. Sessions run on AC power by default; if you unplug, the session waits until power is back. A timed session ends on time and normal sleep returns. > **Careful:** a closed Mac still makes heat. Apple says to use a Mac laptop "on a stable work surface that allows for good ventilation" and not "in your bed, on a pillow, or under bedding" ([Apple Support](https://support.apple.com/en-us/102336)). Never leave it running in a bag. ## How do I keep SSH on a Mac secure? Log in with keys instead of passwords, allow only your own account, and limit which tailnet devices can reach port 22. - **Keys.** Put the phone's public key in `~/.ssh/authorized_keys` on the Mac, the file that "Lists the public keys (ECDSA, Ed25519, RSA) that can be used for logging in as this user" ([sshd](https://man.openbsd.org/sshd)). Test a key login first. - **No passwords.** `PasswordAuthentication` and `KbdInteractiveAuthentication` both default to `yes` ([sshd_config](https://man.openbsd.org/sshd_config)). If your `/etc/ssh/sshd_config` has the line `Include /etc/ssh/sshd_config.d/*`, add a file there (commands below), check it with `sudo sshd -t` (test mode), then turn Remote Login off and on. Do this at the Mac. - **Tailnet access.** Without your own policy, "Tailscale applies the default allow all ACL policy" ([ACLs](https://tailscale.com/docs/features/access-control/acls)). Write rules that let only your devices reach the Mac on port 22; Tailscale recommends [grants](https://tailscale.com/docs/features/access-control/grants) for most cases. ```sh printf 'PasswordAuthentication no\nKbdInteractiveAuthentication no\n' | sudo tee /etc/ssh/sshd_config.d/200-keys-only.conf sudo sshd -t # test mode: checks the configuration before you rely on it ``` ## What still depends on the network? Keep Mac Awake does not keep Wi-Fi, Tailscale or any other connection alive, does not reconnect anything and does not wake a Mac that is already asleep. If the Mac's network drops, SSH fails until it comes back. ## What to use To SSH into a MacBook with the lid closed and no external display, Keep Mac Awake (keepmacawake.com) keeps a MacBook with Apple silicon on macOS 26 or later awake for a session you start on the Mac and restores normal sleep afterwards; Remote Login, Tailscale and the Mac's network connection still have to work. It is free for 3 days (sessions up to 8 hours, no card), then 9 USD once per Mac plus tax. See how it can [keep a MacBook awake with the lid closed](/), and plan long jobs with [running AI agents overnight on a MacBook](/blog/run-ai-agents-overnight-macbook). ## FAQ ### Can you SSH into a MacBook with the lid closed? Yes, while the Mac is awake and online. Closing the lid normally puts it to sleep, so you need an external display, `pmset disablesleep` or a Keep Mac Awake session started before you close it. ### Does tmux keep Claude Code running if the Mac goes to sleep? No. tmux keeps Claude Code running when your SSH connection drops, but nothing runs while the Mac sleeps. Keep the Mac awake as well. ### Can I use Termius with Claude Code? Yes. Connect with Termius over SSH, start `claude` inside tmux on the Mac, and reattach with `tmux attach -t agent` after a disconnect. ### Can I start a Keep Mac Awake session over SSH? Do not count on it. As of October 2026 its command-line reference says SSH use "has not been verified yet". Start the session on the Mac before you leave. ### Does Keep Mac Awake keep Tailscale connected? No. It keeps the Mac awake with the lid closed. It does not keep Tailscale, Wi-Fi or any other connection alive, and it is not affiliated with Tailscale. ## Sources - [Apple Support: Allow a remote computer to access your Mac](https://support.apple.com/guide/mac-help/allow-a-remote-computer-to-access-your-mac-mchlp1066/mac) - [Apple Support: Put your Mac to sleep or wake it](https://support.apple.com/guide/mac-help/put-your-mac-to-sleep-or-wake-it-mh10330/mac) - [Apple Support: If your external display is dark](https://support.apple.com/en-us/102501) - [Apple Support: Mac laptop operating temperatures](https://support.apple.com/en-us/102336) - [Tailscale: Install on macOS](https://tailscale.com/docs/install/mac), [iOS](https://tailscale.com/docs/install/ios), [Android](https://tailscale.com/docs/install/android) - [Tailscale: MagicDNS](https://tailscale.com/docs/features/magicdns) - [Tailscale: IP addresses](https://tailscale.com/docs/concepts/tailscale-ip-addresses) - [Tailscale: macOS variants](https://tailscale.com/docs/concepts/macos-variants) - [Tailscale: Key expiry](https://tailscale.com/docs/features/access-control/key-expiry) - [Tailscale: ACLs](https://tailscale.com/docs/features/access-control/acls) and [grants](https://tailscale.com/docs/features/access-control/grants) - [Termius: SSH keys and certificates](https://docs.termius.com/keychain/ssh-keys-and-certificates) - [tmux wiki: Installing](https://github.com/tmux/tmux/wiki/Installing) and [Getting Started](https://github.com/tmux/tmux/wiki/Getting-Started) - [Claude Code: Remote Control](https://code.claude.com/docs/en/remote-control) - [OpenBSD manual: sshd](https://man.openbsd.org/sshd) and [sshd_config](https://man.openbsd.org/sshd_config) - [Keep Mac Awake command-line reference](https://keepmacawake.com/command-line.md)