Secure Screen Sharing in OS X Leopard Through SSH Tunneling
February 13, 2008
Here's a quick tutorial on how to secure the Screen Sharing application in Leopard by tunneling your connection through an encrypted SSH channel.
The new Screen Sharing application is basically just glorified VNC, but it does come with some nice features (dual-screen view, for example). However, just turning on the service will open up a couple of ports that may expose your system to exploitation.
First, we'll want to lock down your firewall. Leopard comes with two firewalls: ipfw (ipfirewall—the underlying Unix firewall) and an application layer firewall (the one that pops up sometimes and asks if you want to allow an application to accept incoming connections). You can manage the application layer firewall through System Preferences > Security > Firewall, but in order to block some ports we'll need to set up some rules through ipfw. In order to do this, you can either learn the shell syntax (which isn't terribly complicated) or use a GUI app to interface with it. I chose to use WaterRoof—a frontend open-source GUI for ipfw.
Once you have downloaded WaterRoof, run the application and click on Static Rules. Click the + icon to add a new rule, and use the following information:
Protocol: IP
Rule Action: Deny
Source: not me
Port or range: (leave blank)
Destination address, subnet, or network: me
Port or range: 5900
In, Out, or In/Out: Select the In radio button
This will block port 5900, the default VNC listening port that is opened when you start Screen Sharing. Also, you'll want to block port 88 unless you are using Kerberos for authentication (I believe this is also opened by Screen Sharing and a couple of other apps). Add a new rule and use the same above parameters, but use incoming port 88 instead of 5900.
You should now have two new rules in your table:
deny ip from not me to me dst-port 5900 in deny ip from not me to me dst-port 88 in
Click Tools > Rules Configuration > Save to startup configuration. Then, click Tools > Startup Script > Install Startup Script. This will make these new rules persist when you restart (otherwise, the system will reset to defaults on the next restart).
Open up Terminal and edit your /etc/sshd_config file with your favorite editor. In order to enable port forwarding add this line to the end of the file:
GatewayPorts yes
Now, open System Preferences > Sharing and enable the Screen Sharing and Remote Login services.
On your other Mac...
Now, from your client computer, open up Terminal and run the following (for reasoning, see the LifeHacker article Add More Functionality to Leopard's Screen Sharing):
defaults write com.apple.ScreenSharing ShowBonjourBrowser_Debug 1
and (to enable quality control settings)...
defaults write com.apple.ScreenSharing \ 'NSToolbar Configuration ControlToolbar' -dict-add 'TB Item Identifiers' \ '(Scale,Control,Share,Curtain,Capture,FullScreen,GetClipboard,SendClipboard,Quality)'
Finally...
Now, any time you want to securely connect to your Mac, all you have to do is type the following in Terminal:
ssh username@ip_address_or_hostname -L 5900:localhost:5900
The -L flag is the key to all this—it enables local port forwarding and specifies that anything that happens on the specified local port will be forwarded to the given remote host and port (see the man page for more info). The format of the -L option is port:host:hostport so the first 5900 is your local client port, the next option is the host to which to forward, and the third is the remote port. It's slightly confusing at first, but this localhost isn't the client you're connecting from, it is the remote computer to which you are connecting—it means that when the remote host gets forwarded data, it won't pass it on to some other host.
Now, leave that terminal window open and open up /System/Library/CoreServices/Screen Sharing.app (you can drag it to your dock).
In the connect field, type localhost:0 (don't forget the :0). The last part is important because it means to connect to display zero, which translates to port 5900 in VNC land and, for some reason, Leopard will tell you that "You cannot share your own computer" if you type in just localhost (though, you actually can by enabling Screen Sharing and typing that same host, it just creates an pseudo-infinite loop of VNC windows).
Once you type in your username and password, you're done! You can now control your computer remotely through Leopard's Screen Sharing app over a tunneled SSH connection. Here's an example of the Screen Sharing interface (notice the nice dual-monitor support):
Also, because Screen Sharing uses VNC as its base protocol you can interface with your Mac from any Linux, Mac, or Windows VNC client by port forwarding in the same way (on Windows, you'll have to use an SSH client like PuTTY) and connecting to localhost port 5900 with any standard VNC client.