Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have an OS X 10.6 server, which I administer via SSH and VNC (via SSH tunnel).

I can't leave it at the login window since then VNC connections are refused. Therefore I currently leave it logged with my user account.

Since it doesn't have a monitor attached, it doesn't go into screen saver mode, which means it doesn't require a password to retake control. This means it is very easy for anyone connecting a keyboard/mouse and monitor to take control of the system.

The screen saver password protection, which I can't get to activate, unlike the system's login window, is perfectly compatible with VNC connections.

How could I prevent such direct access to the server without connecting a monitor and without blocking my ability to connect with VNC?

Thanks!

share|improve this question

5 Answers 5

up vote 1 down vote accepted

There are at least two ways you can do this. You can initiate the screensaver at any time using the optional menubar item, which isn't present by default. Open /Applications/Utilities/Keychain Access.app --> Preferences --> General [tab] --> Show status in Menu Bar. Here, you can choose Lock Screen from the lock icon in your menu. In the least, you should choose Lock All Keychains to prohibit your admin credentials from being used in a GUI tool, then Lock Screen.

Alternatively, in System Preferences --> Security --> General [tab] --> Require Password [pulldown menu] after sleep or screen saver begins. And then System Preferences --> Desktop & Screen Saver --> Start Screen Saver [slider indicating time to automatically start screensaver].

share|improve this answer
    
Thanks! _________ –  GJ. Feb 2 '11 at 21:29

Have you considered using Remote Desktop instead of VNC?

share|improve this answer
    
I'm using the Mac's built-in screen sharing, which is nearly identical to Remote Desktop (isn't it?) –  GJ. Apr 4 '10 at 18:04
2  
Apple Remote Desktop adds several extra features. Most important for your case is that it adds the ability to lock the screen of the machine you're remotely controlling, so you can remotely control it without letting anyone locally control it or even see what you're doing. –  Spiff Apr 4 '10 at 18:38

Have you considered locking it up? Put it in a box and lock it. Leave only enough holes for airflow(many small and/or thin ones) and the only big holes are there to permit power and network cables.

share|improve this answer

I can't test if this might work in your environment, but you can launch the screen saver from the command line with the following command

/System/Library/Frameworks/ScreenSaver.framework/Resources/ScreenSaverEngine.app/Contents/MacOS/ScreenSaverEngine

You could wrap this in a bash script or something like that to call it in a more simple way.

share|improve this answer
    
great idea. but how would i set it to auto-activate after a certain period of inactivity? there isn't a real mouse or keyboard connected, so the inactivity criteria should be of VNC sessions –  GJ. Apr 4 '10 at 18:06

Why won't VNC work if you leave it at the login screen? It works for me on 10.6 using RealVNC Viewer.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.