How to use Apple Screen Sharing (VNC) with 2FA

How to access your Maths office Mac from an "outside" (home or overseas) machine e.g. a Mac laptop, with SSH (with 2FA) and Screen Sharing (really VNC) on MacOSX: work as if you were sitting in front of your office Mac.

You need to (once only):

Each time you want to connect to your office Mac, you need to: When done, close your Screen Sharing app, then you can log out of enna also.

Contents

Find name of your office Mac

Find out the network name of your office Mac: usually something like pXYZm.pc (with XYZ your room number).

Prepare for 2FA on your account

Prepare for 2FA as per the instructions in the SSH HowTo.
You need Web-OTP or TOTP or skeys; no need for X-windows or other features that SSH offers.
(No need to follow the "messy" recommendations in a nutshell.)

Set up Screen Sharing (VNC) service on the office Mac

The Screen Sharing (VNC) server is built-in to Macs, only needs to be turned on.
Also need to configure the firewall to allow, and ensure the Mac will not go to sleep.

In System Preferences:

Run SSH on the laptop

To test things out while in the School but as if from outside, connect your laptop to UniSydney wireless.

Ensure your laptop is not running a VNC server itself.

Run ssh: in a terminal window, type the command

ssh -C -L 5900:pNNNm.pc:5900 MATHSNAME@maths.usyd.edu.au
with the name of your office Mac, and your Maths (enna) login name.

Follow the prompts: type the words from your paper skey sheet for the line number shown, or the authenticator code, then your normal enna password. You will be logged in to enna.

The very first time you use ssh, you will be prompted about the as-yet unknown authenticity fingerprint: say yes.

Leave that enna window logged in, running; you may minimize/iconize its window. Keep that session running, do not allow to time out, do not allow your computer to go to sleep/hibernate e.g. as most laptops do with the lid closed.

Connect with Screen Sharing app (VNC client)

With ssh running, logged in to enna...

In Finder choose Go and Connect to Server, in the Server Address field type

vnc://localhost
and click Connect.
Some (Mac?) machines do not know about localhost, then use 127.0.0.1 instead of the name localhost.
Set the correct username and password, click Connect, and see it connect to your office Mac, just as if you were sitting in front of its screen.

You can also copy files between the office Mac and the laptop e.g. by simple drag-and-drop. You can minimize/iconize the Screen Sharing window, or make it un-maximized.

Alternatively you could start things from a terminal window (another terminal, not the enna one), typing the command
     open vnc://localhost
Or, find the app in /System/Library/CoreServices and drag it to your Launchpad, start it and connect to machine named localhost.

When done, just close the Screen Sharing window.

After disconnecting your Screen Sharing (VNC) session, you may close the ssh window (log out the enna session): type  exit  at the enna prompt, or just close the terminal window.

Blurb, comments

The Mac OSX "Screen Sharing" is based on VNC, Virtual Network Computing.

The remote "laptop" machine could be Linux or Windows: Linux has SSH and you could install some VNC viewer (say xtightvncviewer), for Windows you could use putty and one of many free VNC viewers; but we will not describe how to use such other machines.

You could use VNC for office Windows PCs also, but for those you are better off with RDP that is "native" to Windows.

Further reading, random references

http://osxdaily.com/2012/10/10/remote-control-mac-screen-sharing-os-x/
http://osxdaily.com/2013/04/05/vnc-client-mac-os-x-screen-sharing/
http://support.apple.com/guide/mac-help/share-the-screen-of-another-mac-mh14066/mac
http://www.wikihow.com/Set-Up-VNC-on-Mac-OS-X
http://en.wikipedia.org/wiki/Virtual_Network_Computing
http://en.wikipedia.org/wiki/Screen_Sharing
https://superuser.com/questions/117419/remote-desktop-to-mac-from-various-platforms-windows-ubuntu


Paul Szabo psz@maths.usyd.edu.au 14 Dec 23