How to ssh and remotely manage GUIs on my iMac with Remote Login/Management?

Question

I am having trouble being able to fully control my computer remotely. By fully, I mean being able to {manage files, access the terminal, access GUI, login} all while not allowing a local user to take over.

I need to be able to control the screen, to run an installer program, for instance. The problem that I'm having with screen sharing and remote desktop is that the local user can see me log in then take control with the mouse. Then they are logged into my administrative account. They also cannot use their account while I'm logged into mine. How do I avoid this?

Another problem I am having is that while the remote computer can be accessed via a public ip and it is listed in Finder on the LAN, there doesn't appear to be a way to simply find the computer remotely via iCloud. Remote login is an example program that does this. Even if I kept track of where the computer was plugged in to the internet, the ip may change. Is there a way to find the computer based on the account instead of the network address?

In summary, I want to:
1. Be able to run a GUI installer safely isolated from local users.
2. Be able to ssh into the admin account safely isolated from local users.
3. Be able to locate my computer to connect as dependably as "Find my Mac" does, using something dependable like my iCloud account instead of a network address that may change.

Answer 1

Apple Remote Desktop (ARD) has a Curtains mode that blocks the local user from seeing what's happening on the screen. It may meet your needs.https://www.apple.com/remotedesktop/remoteassistance.html

Answer 2

Answering your questions in order....

1. Unless you are willing to pay for a premium application like ARD or LogMeIn, you won't get those features.

As mentioned in another answer ARD has "Curtain Mode" -

For those times when you want your actions to be hidden from the end user, there’s Curtain Mode. This allows you to block the view with a virtual curtain, while retaining full control of the screen. It’s perfect for those working on public‑facing systems.

LogMeIn has a blanking of the host screen feature:

Protect your data by blanking the host display during a remote control session.

Lock the host keyboard and mouse to prevent anyone sitting at the host machine from entering data during a remote control session.

I personally use Teamviewer and while this option is available in Windows, it's not available on macOS or Linux. Apparently it has something to do with how (easily) Windows handles DPMS (Display Power Management Systems) and how (badly) macOS/Linux implements it.

(speaking from experience, ARD's curtain mode was "iffy" at best)

2. By default, you can ssh into any account (root being the notable exception) as long as you have Remote Login enabled. You can log in while someone else is sitting at the machine without them ever knowing you were there. This is by default. If you need root access, create an "admin" account and su to root or issue commands via sudo.

3. To reliably find your computer, use DDNS (Dynamic DNS) and assign your computer a FQDN like (foobar.dyndnsprovier.com).

freedns.Afraid.org provides a nice free DynDNS service that you can utilize to access your computer (or home network) even if your IP address changes. In your case, you will need to execute a script via launchd (or chron) that updates the IP on a periodic basis. Once you have that in place, you can access your computer by hitting up the FQDN (foobar.dyndnsprovider.com). The script and how to implement it on your machine is out of the scope of this answer.

MAJOR Caveat: If the machine is behind a firewall that you don't control and disallows SSH trafic or doesn't have it mapped to your IP or port, you are out of luck - this will not work. Stick with LogMeIn or TeamViewer.

Answer 3

Instead of the proposed methods, you can log in while another user is logged in and start a new session instead of sharing the screen. This will not be visible or accessible to the local user. Use vnc://<mac name or ip> from the Connect window in Finder to connect to the system. I’m not sure if I can permanently upload an image, but the dialog shown will be asking you if you want to share the other user’s session or login to a new one as yourself. This only works if the local user is not the same as the user you are trying to login to.

This works much like fast user switching, but instead of switching accounts locally, you can use them concurrently, locally and remotely! This also means that you could walk up to the computer and log out the current user or return to the login window and you will see yourself listed as currently logged in. This also allows you to locally take over your remote session if you wanted to.

Remote Access outside of the network

If you need remote access from outside of the network, it's a different deal. And if you don't know the address either, it's a problem too. The functionality you are proposing is usually used in business networks where there is a local administrative system in place. If you only have a single system somewhere remote (i.e. a single Mac somewhere in a house), you might be able to deal with it using iCloud, with the "Back to my Mac" feature. Another way would be port forwarding the VNC connection, but that leave a huge security hole, and is not recommended. You can also use SSH tunnels, meaning you only have to leave open the SSH port, and then in the command line you simply forward the remote VPN port over that secure connection, like this:

ssh user@mac-somewhere-else -L1234:localhost:5900

Then, while you leave that open in the terminal, you use vnc://localhost:1234 in the Finder's Connect To dialog (Command-K) and this will use the SSH tunnel to the other Mac.

However, if you are targeting many remote machines or mobile machines or systems that you cannot access directly, you will need a special agent installed that uses NAT traversal via a third party service. Previously mentioned tools do this, i.e. LogMeIn, TeamViewer and similar types.

If you have multiple remote networks to access regularly, consider using VPN connections. This allows you to connect to the network remotely and access the resources within.

A third alternative for accessing remote networks is using a jump box or bastion host. It could be a simple Mac Mini that has a static IP address and SSH (or maybe even VPN) and you first log in to that and tunnel VNC to it. Next, on that Mac, you use the Finder's sidebar to automatically discover all the other systems in the network.

To have a better set of options to solve this, we will need more information on the use cases and what networks etc. you actually want to connect to.