I have enabled Remote Management on a mac. Everything works fine when I connect from another mac using Apple's Remote Desktop app. However, I also want to have a client on a windows machine. In that case can I go to the computer settings under Settings > Sharing > Remote Management and there is an option "VNC users may control screen with password" where one can give a password for accessing them.

From what I understand the initial transaction of exchanging the password is done securely. However, all subsequent transactions are not. This implies that when a user attempts to login to the machine and gives his/her actual password, then that password is out there without any encryption what so ever. So, what I would like to do is to allow VNC connections only when the client has already established an ssh tunnel with the server/machine. However, I do not see such an option anywhere.

So, what I really want is to force this ssh tunnel on the client side. On the other hand, just letting it to good will of the clients is not a good idea, especially if I rely on people running windows to have to remember constantly to tunnel say through putty and only then attempt to use vnc.

Moreover, Apple's Remote Desktop app does allow full encryption for all interactions by selecting an option under preferences > security (on the client side). I can be OK with that in the sense that this option should be enabled once, and from that point and on all subsequent interactions will be encrypted. (By the way, is there a windows program out there with such a simple option so that one can use it under windows and connect to a mac?) However, the problem remains here as well, as I am not sure how the server would force all the transactions to be encrypted. There is again no option on the server side for such a thing.

Is what I am trying to ask irrational?

I am looking forward to your answers.

2 Answers 2


I would advise you to create a permanent ssh tunnel so you can local forward the connection port from the Windows host to the connection port on the Mac host using Bitvise Tunnelier: https://www.bitvise.com/tunnelier, while not personally having used it, this question explains a similar problem: https://superuser.com/questions/235395/automatic-ssh-tunneling-from-windows

  • That's a helpful response and I am up-voting. However, I think that this does not really address my (now outdated) concern of enforcing ssh-tunneling on the server side. Commented Mar 16, 2016 at 23:32

I am not sure I understand your question fully (please rewrite/clarify it) but if you have VNC on a certain machine A and want to prevent B and C to connect to A without using an ssh tunnel, just block the VNC port (typically 5900) in A's firewall (and open port 22 for ssh).

  • How would you create the ssh tunnel for port 5900 that you block in A's firewall? Commented Apr 12, 2014 at 18:18
  • You've probably figured out by now, but you would use ssh -L 5900:localhost:5900 user@remotehost; even with the default VNC port blocked by firewall settings, the loopback connection through the SSH tunnel would still allow for Screen Sharing.
    – Bob
    Commented Jan 29, 2023 at 23:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .