Protecting Mac Screen Sharing Behind SSH

Important: Complete the SSH setup before making this change
This configuration will prevent direct Screen Sharing connections to your Mac, including connections from devices on your local network. Before proceeding, make sure Remote Login is enabled on your Mac and that Screens is configured to use Secure Connections, including Enable on Local Connections, as described below. Otherwise, Screens will not be able to connect.

Starting with macOS 10.12 Sierra, macOS can be configured so that its built-in Screen Sharing service only accepts connections originating from the Mac itself. This prevents other devices from connecting directly to the Screen Sharing (VNC) service over the network.

Screens can still connect to the Mac by establishing a secure SSH connection first and tunneling the Screen Sharing connection through it.

Before You Begin

Because direct Screen Sharing connections will no longer be accepted after making this change, Remote Login (SSH) must be enabled on your Mac.

Open System Settings.
Go to General > Sharing.
Enable Remote Login.
Make sure your Mac user account is allowed access.

You'll also need to configure Screens and Screens Connect, if installed, to use secure connections as described below.

Configure Screens

Before restricting Screen Sharing to local connections, edit your saved connection in Screens and open the Security section.

Enable Secure Connections and make sure Enable on Local Connections is also turned on.

This is important: once Screen Sharing is restricted to local connections, Screens must use SSH even when your device is on the same local network as your Mac.

Configure Screens Connect

If you use Screens Connect, open its settings, select General, and enable Use Remote Login.

This ensures that Screens Connect configures remote connections to use SSH instead of connecting directly to the Screen Sharing service.

Restrict Screen Sharing to Local Connections

Once Remote Login and the SSH options above are configured, open Terminal on the Mac and enter:

sudo defaults write /Library/Preferences/com.apple.RemoteManagement.plist VNCOnlyLocalConnections -bool yes

Enter your Mac user account password when prompted.

The VNCOnlyLocalConnections setting instructs macOS Screen Sharing to listen only for connections originating from localhost. As a result, direct Screen Sharing connections from other devices will no longer be accepted.

Reverting the Change

If you want macOS Screen Sharing to accept network connections directly again, open Terminal and enter:

sudo defaults write /Library/Preferences/com.apple.RemoteManagement.plist VNCOnlyLocalConnections -bool no

You can then disable the SSH-specific settings in Screens and Screens Connect if you no longer want to use secure connections.