0

One of the reservations I've had with ARD is that it allows anyone on the same network as you to access your computer, as long as:

  • ARD is enabled (this can be confirmed by scanning with the ARD client software)

  • Your username (most likely the same or similar to your computer name that shows up in the ARD client software)

  • Your password. (this is not so easy to figure out, but most users seem to be a bit more lax with their local machine password, than they would with say a cloud account password, which may be managed by a password manager)

The problem with this is that there doesn't seem to be any brute force protections, built into ARD, nor key / certificate method, where you could setup a key in advance.

I think I've found a way around this to some extent, but wanted to know if this would actually work, or if there are any shortcomings in this. My work-around would be to create a new user on the machine I plan to be the ARD host. This user account would be called, for example, "ARD", and have a really strong password manager generated password.

I would then use my the ARD client machine to login to the ARD user on the host. What I've noticed is that once you've connected, and as long as you have the usernames / passwords for the other user accounts on the host machine, you can login to those other user accounts, even if those other users don't have ARD enabled under the preference tab.

Are there any potential issues you could see with the above ?

  • I don't see how ARD is the issue here. as long as you have the usernames / passwords for the other user accounts on the host machine, you can login to those other user accounts, - uh yeah. If you have the usernames/passwords for other users you can obviously log into their accounts. – Allan Dec 28 '18 at 12:49
  • @Allan the issue i believe is that usually a users local password is not that strong (not as strong as it should be) this is mitigated, by the fact that you have to "usually" by in physical possession of the machine to access it. But if ARD is enabled and you are on a public wifi anyone can try and brute force an ARD connection, here the weaker local password becomes more of a vulnerability. By making a user only for ARD my plan was that at least that user could have a strong unique password and from that ARD user i would access the other accounts. – sam Dec 28 '18 at 13:57
  • You can't just shoehorn an ARD connection to a random machine. You must have an Admin account and password to connect to ARD – Allan Dec 28 '18 at 14:13
  • @Allan That is incorrect, any user use ARD, but you will have to specify who. Admins is the only group that can be activated with a "toggle" – Gert-Jan Roeleveld Dec 28 '18 at 14:49
  • @Gert-JanRoeleveld - the point is, you have to be allowed to access ARD; the comment is in the context of being on a public wifi. – Allan Dec 28 '18 at 14:51
1

The protection of the ARD is in the fact that you can enable and disable users for this feature.

The brute force protection is that of the user account. You can set it up to lock after 5 failed attempts or what ever you please.

It is strongly advisable NOT to use an Admin account for this, but instead use a normal account to give access to the ARD, and using account switching or admin privilege escalation where and when you need it. Part of the reason being is that you can take over the session of any user currently logged in that way, without the user knowing. So IF you are worried about people breaking in to your account, that is the way to minimise the risk as far as possible. (Best practice is that nobody is admin on a Mac apart from a dedicated account that can be used for privilege escalation instead)

Hope this helps in your decision making process.

GJ

  • how can i set the system to lock after 5 failed attempts ? Im running 10.13.6 – sam Dec 28 '18 at 18:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .