VNC for multiple users on one machine

Question

I'm on a machine running OS X 10.5 and that has several user accounts. Is there some way for one of those users to ssh into the machine, launch a vnc server, and then connect to it? I have tried Vine Server which is supposed to have similar capabilities, but it seems to be either use ssh to start the server, or have the server already started in each account, but not both.

Thanks

Answer 1

Built into the operating system - no.

You'll want to look at Aqua Connect Terminal Server and question 8966 here on Server Fault.

Answer 2

I mucked about with this some time ago (on Tiger?), and never did come up with a good solution. I found that you had to log a user in graphically, then start the VNC server, and afterwards, you could use fast user switching to switch to a different user and log them in. So, it really meant that no one could use the Mac itself [edit: as the fast-user switching dialog would come up] -- they'd all need to be connected over VNC, but it was nice to see that the Mac would happily run multiple sessions. [edit: Also, while multiple people could use the computer at once, only one could be in the process of logging in at a time, which took 30 seconds to a minute.]

One thing to note: in the netbooting guide, I believe it states that you need an OS licence for each machine that will netboot; I assume that the same applies to a VNC setup like this.

I don't remember it, but here are some notes and some code for you to play with (at your own risk).

Mac Thin-Client Plan
---------
Client:
Uses paramiko script.  User is asked for name and password.  Tries to connect.  Alerts user on failure.
If it connects, it CDs to a certain directory on the server, and calls a function, using the name and password.

Server:
Script is run.  Server checks if it is able to log the user in at that moment.
When permitted, the console comes up, and then a VNC server is started.
Server tells client which port VNC server is started on.

Client then exits paramiko application, and launches a VNC application.
When VNC application is exited, client goes back to the log-on screen.

StartVNCLogin.sh (to be run on the Mac acting as a server):

#!/bin/bash

# This script should be runnable by any user.  It takes two parameters -- the user's name and password.
# This script should be owned by root, and should let the owner read/write/execute, but no other user.
#   sudo chmod 700 /sbin/StartVNCLogin.sh
# In /etc/sudoers, the script needs to be set up so all users can run it.
# See http://mandrivausers.org/lofiversion/index.php/t33702.html.
#   use visudo to add "ALL ALL=NOPASSWD: /sbin/StartVNCLogin.sh" to the end of the file

# With the parameters -- the user name and password -- the script will switch to the login screen,
# and will then use applescript to log the user in
# Afterwards, it will start a VNC session for that user, and return the port number.
# At this point, the client can connect via VNC.

say "Log on called"

# Do we have root access?
if [ ! $( id -u ) -eq 0 ]; then
    echo "Error: Script must be run with administrator priviledges"
    exit -1
fi


# Get the user name and password
if [ "$#" = "2" ]; then
    export USERNAME="$1"
    export PASSWORD="$2"
else
    echo "Error: Please supply a username and password."
    exit -2
fi

# This step should not be necessary, as the user had to use ssh to run this script
# Verify that the user exists on the system
USERID=`id -u $USERNAME`;
if [[ -z $USERID ]]; then
    echo "Error: The user $USERNAME does not exist on this machine"
    exit -3;
fi;


# Now, switch to the login screen
echo "Info: bringing up login screen" 
# Ask the logon screen to come up and allow us to log-in as the desired user
#/System/Library/CoreServices/Menu\ Extras/User.menu/Contents/Resources/CGSession -switchToUserID $USERID &
/System/Library/CoreServices/Menu\ Extras/User.menu/Contents/Resources/CGSession -suspend

sleep 15

# Then, use applescript to enter the user's password
echo "Info: logging user in"

# And enter in the password
osascript <<END
set pword to system attribute "PASSWORD"
set username to system attribute "USERNAME"
tell application "System Events" 
    keystroke username
    keystroke return
    delay 1
    keystroke pword
    delay 1
    keystroke return
    keystroke return
end tell
END

echo "Info: Waiting for user to be logged in"


echo "Info: Starting VNC server."

# Now, we start the VNC server
if [ -x /Applications/Vine\ Server.app/Contents/Resources/OSXvnc-server ]; then
    /Applications/Vine\ Server.app/Contents/Resources/OSXvnc-server -rfbport 0 -desktop "New Desktop" -rfbnoauth -restartonuserswitch N -unicodekeyboard 0 -keyboardloading n -pressmodsforkeys n -eventtap 3 -swapbuttons -rendezvous y &
else
    "Error: Can not find the VNC server application!  The server is not properly configured for VNC login."
    exit -4;
fi;

Important parts from the client script (to be run on linux):

# note that I am redirecting stderr to stdout for simplicity
chan.exec_command("sudo /sbin/StartVNCLogin.sh " + username + " " + pw + " 2>&1")
stdout = chan.makefile('rb') 

vnc_port = -1

for line in stdout:
	print '... ' + line.strip('\n')
	# look for a line where a port is stated
	if line.find("Started Listener Thread on port") > -1:
		vnc_port = int(line.rsplit(' ', 1)[1])
		print "--- The VNC Port is %d" % vnc_port
		chan.close()	# sever the connection; we know what we need to know

print "Done"

#chan.close()
t.close()

os.system("vncviewer %s:%d -Shared -Fullscreen" % (hostname, vnc_port))

Answer 3

Set up Xvnc with XDMCP, and then they can vnc and log into the server. There are many guides on the internet on how to set it up, here's one.

Answer 4

OS X 10.5 already contains a VNC server which can be configured on an account by account basis.

I think (don't have a Mac in front of me) that you can find the settings in System Preferences->Sharing. Something like that.

Answer 5

We're happily using a combination of Vine Server for OSX and JollyFastVNC for the clients.

Vine Server provides for a "personal" VNC server instance on a unique port number for each logged in user. The only trick is that the user needs to be already logged into the Mac with VineServer running under their account to be able to VNC in. The solution for the bootstrap problem this introduces is the Vine Server "System Server" that provides a VNC session for the Mac console - and thus, let's any user with access the console session log themselves into the Mac (and thus, start their own private Vine Server instance)

Configuration is relatively easy:

1/ Turn on Fast User Switching so that multiple users can share the Mac.

2/ Log in on the actual Mac console as an admin user that you also want to grant remote access to. Launch Vine Server as that user, and check the "Open at Login" preference.

3/ Open Vine Server Preferences and note the port number assigned to this VNC server instance. Manually re-enter that number to "pin" this instance to that port for subsequent launches. Also recommend that you set the password here for this unique user session.

4/ Go to the Sharing tab and make sure you check "Allow multiple user sessions"

5/ Go to the Startup tab and check the "System Server..." button. Start the system server instance on the default port (5900). This will be your console VNC server to use. (I recommend that you set a password on this)

6/ Close the preferences window and click Restart Server button.

You should now be able to log into two VNC user sessions: one as the Console on port 5900 and one as the admin user you just logged in as.

Now, for each user, have them log in and add Vine Server to their dock and repeat steps 2, 3 and 4 above.

The only two issues we've noted with this are that, if the Mac is power cycled, the System Server won't start automatically. An initial user needs to log in and start it via the UI.

The second issue is that if a user logs in via the remote VNC Console session, their subsequent use of the Mac will be visible in both the console session and their "personal" VNC session. i.e. the console session remains bound to the last logged in user until someone else logs in either remotely or locally. We work around this by opening the remote console session again after logging in and using fast-user switching to "show login window" which seems to force the console session to dissociate again.

JollyFastVNC enter the picture as a bonjour-aware VNC client with a nice "available servers" browser. This offers up the remote Mac "hostname:port" for each running Vine Server instance and the console instance, allowing easy navigation if you can't recall your port numbers.

Hope this helps.