Starting with macOS 10.12 Sierra, macOS can be configured so that its built-in Screen Sharing service only accepts connections originating from the Mac itself. This prevents other devices from connecting directly to the Screen Sharing (VNC) service over the network.
Screens can still connect to the Mac by establishing a secure SSH connection first and tunneling the Screen Sharing connection through it.
Before You Begin
Because direct Screen Sharing connections will no longer be accepted after making this change, Remote Login (SSH) must be enabled on your Mac.
- Open System Settings.
- Go to General > Sharing.
- Enable Remote Login.
- Make sure your Mac user account is allowed access.
You'll also need to configure Screens and Screens Connect, if installed, to use secure connections as described below.
Restrict Screen Sharing to Local Connections
Open Terminal on the Mac and enter:
sudo defaults write /Library/Preferences/com.apple.RemoteManagement.plist VNCOnlyLocalConnections -bool yesEnter your Mac user account password when prompted.
The VNCOnlyLocalConnections setting instructs macOS Screen Sharing to listen only for connections originating from localhost. As a result, direct Screen Sharing connections from other devices will no longer be accepted.
Configure Screens Connect
If you use Screens Connect, open its settings, select General, and enable Use Remote Login.
This ensures that Screens Connect configures remote connections to use SSH instead of connecting directly to the Screen Sharing service.
Configure Screens
Edit your saved connection in Screens and open the Security section.
Enable Secure Connections and make sure Enable on Local Connections is also turned on.
Screens will then establish an SSH connection to your Mac and tunnel the Screen Sharing connection through it.
Reverting the Change
If you want macOS Screen Sharing to accept network connections directly again, open Terminal and enter:
sudo defaults write /Library/Preferences/com.apple.RemoteManagement.plist VNCOnlyLocalConnections -bool noYou can then disable the SSH-specific settings in Screens and Screens Connect if you no longer want to use secure connections.