Force screen sharing to bind to second network?

To close the loop on this, I wanted to report back and document what I ended up doing for anyone else looking to make screen sharing a bit more secure. This worked for me but if your Mac bursts into flames, sorry.

Modified from https://gist.github.com/mhofman/171539fa11052aae785fd19d8b382664

Force screen sharing to listen on localhost only and connect via ssh tunnel

The solution is to disable the /System/Library/LaunchDaemon and use a "launcher" daemon that will forcibly load the modified /Library/LaunchDaemon. You must still activate Screen Sharing through the preferences or else it will end up in observe only mode.

On the remote host:

Activate Screen Sharing in the System Preferences

$ sudo cp /System/Library/LaunchDaemons/com.apple.screensharing.plist /Library/LaunchDaemons/com.apple.screensharing.plist

In /Library/LaunchDaemons/com.apple.screensharing.plist, edit the Sockets section. This will force screen sharing to listen on localhost only.

<key>Sockets</key>

  <dict>

    <key>Listener</key>

    <dict>

      <key>SockNodeName</key>

      <string>localhost</string>

      <key>SockServiceName</key>

      <string>vnc-server</string>

    </dict>

  </dict>

Create /Library/LaunchDaemons/com.apple.screensharing.launcher.plist with the following content:

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

  <key>Label</key>

  <string>com.apple.screensharing.launcher</string>

  <key>LaunchOnlyOnce</key>

  <true/>

  <key>RunAtLoad</key>

  <true/>

  <key>KeepAlive</key>

  <false/>

  <key>ProgramArguments</key>

  <array>

    <string>/bin/launchctl</string>

    <string>load</string>

    <string>-F</string>

    <string>/Library/LaunchDaemons/com.apple.screensharing.plist</string>

  </array>

</dict>

</plist>

$ sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.screensharing.plist

$ sudo launchctl load -w /Library/LaunchDaemons/com.apple.screensharing.launcher.plist

Create an ssh tunnel and use vnc over the tunnel

On the local client:

$ ssh user@remotehost -L 5901:localhost:5900

Then using Connect to Server (Command-K) connect to vnc://localhost:5901

I chose 5901 as the local port but it can be any unused port above 1024.

Enable password-less ssh key login

On the local client:

If ~/.ssh/id_ed25519.pub doesn’t already exist, run:

$ ssh-keygen -t ed25519

Accept the defaults

Copy the contents of id_ed25519.pub to the remote host:

$ cat ~/.ssh/id_ed25519.pub | ssh user@remotehost 'cat >> ~/.ssh/authorized_keys'

Now, ssh should login using the key.

Force ssh-key-ONLY login

On the remote host, first make sure password-less key login from all required clients works.

Edit /etc/ssh/sshd_config and change these lines to the following:

PasswordAuthentication no

ChallengeResponseAuthentication no

Now, you can only ssh in with a key, a password is not accepted.

Yes, the 10Gb and WiFi networks are on different subnets -- 172.16 and 10.0.

When you connect via screen sharing, try using the IP address of the other device that it has on that 10G network.

Connecting via the 10Gb 172.16 address even though the Screen Sharing prefs say it's listening on the 10.0 address can work for some period of time but it eventually fails and then only responds on the 10.0 address. I'm not sure what the trigger is.

Is there a way to modify this so instead of binding screen sharing to localhost, bind it to the 10Gb interface? https://gist.github.com/mhofman/171539fa11052aae785fd19d8b382664

Thanks for the response BobHarris. I will try your local port forwarding method but my understanding of what's happening is that the Mac stops listening for Screen Sharing requests on the 172 network and only responds on the 10 network. If I toggle its service order or add a router in its 172 network settings it will start listening on the 172 network again. But as I mentioned earlier, this breaks internet access over WiFi. The 172 network has no route to the outside.

We only want the 10Gb networked Macs to listen for screen sharing on the 10Gb 172 network, regardless of the service order or entries in the router field.

BobHarris, I recall seeing a defaults write setting to only accept screensharing connections from localhost and then one would ssh into a port that's mapped to localhost. Or something like that.

MrHoffman, Interesting about the response getting lost. I'll have to figure out how to view ScreenSharing logs in Ventura to see if the connection attempt is made on the 172 network but the response goes out on the wrong interface.