I mucked about with this some time ago (on Tiger?), and never did come up with a good solution. I found that you had to log a user in graphically, then start the VNC server, and afterwards, you could use fast user switching to switch to a different user and log them in. So, it really meant that no one could use the Mac itself [edit: as the fast-user switching dialog would come up] -- they'd all need to be connected over VNC, but it was nice to see that the Mac would happily run multiple sessions. [edit: Also, while multiple people could use the computer at once, only one could be in the process of logging in at a time, which took 30 seconds to a minute.]
One thing to note: in the netbooting guide, I believe it states that you need an OS licence for each machine that will netboot; I assume that the same applies to a VNC setup like this.
I don't remember it, but here are some notes and some code for you to play with (at your own risk).
Mac Thin-Client Plan
Uses paramiko script. User is asked for name and password. Tries to connect. Alerts user on failure.
If it connects, it CDs to a certain directory on the server, and calls a function, using the name and password.
Script is run. Server checks if it is able to log the user in at that moment.
When permitted, the console comes up, and then a VNC server is started.
Server tells client which port VNC server is started on.
Client then exits paramiko application, and launches a VNC application.
When VNC application is exited, client goes back to the log-on screen.
StartVNCLogin.sh (to be run on the Mac acting as a server):
# This script should be runnable by any user. It takes two parameters -- the user's name and password.
# This script should be owned by root, and should let the owner read/write/execute, but no other user.
# sudo chmod 700 /sbin/StartVNCLogin.sh
# In /etc/sudoers, the script needs to be set up so all users can run it.
# See http://mandrivausers.org/lofiversion/index.php/t33702.html.
# use visudo to add "ALL ALL=NOPASSWD: /sbin/StartVNCLogin.sh" to the end of the file
# With the parameters -- the user name and password -- the script will switch to the login screen,
# and will then use applescript to log the user in
# Afterwards, it will start a VNC session for that user, and return the port number.
# At this point, the client can connect via VNC.
say "Log on called"
# Do we have root access?
if [ ! $( id -u ) -eq 0 ]; then
echo "Error: Script must be run with administrator priviledges"
# Get the user name and password
if [ "$#" = "2" ]; then
echo "Error: Please supply a username and password."
# This step should not be necessary, as the user had to use ssh to run this script
# Verify that the user exists on the system
USERID=`id -u $USERNAME`;
if [[ -z $USERID ]]; then
echo "Error: The user $USERNAME does not exist on this machine"
# Now, switch to the login screen
echo "Info: bringing up login screen"
# Ask the logon screen to come up and allow us to log-in as the desired user
#/System/Library/CoreServices/Menu\ Extras/User.menu/Contents/Resources/CGSession -switchToUserID $USERID &
/System/Library/CoreServices/Menu\ Extras/User.menu/Contents/Resources/CGSession -suspend
# Then, use applescript to enter the user's password
echo "Info: logging user in"
# And enter in the password
set pword to system attribute "PASSWORD"
set username to system attribute "USERNAME"
tell application "System Events"
echo "Info: Waiting for user to be logged in"
echo "Info: Starting VNC server."
# Now, we start the VNC server
if [ -x /Applications/Vine\ Server.app/Contents/Resources/OSXvnc-server ]; then
/Applications/Vine\ Server.app/Contents/Resources/OSXvnc-server -rfbport 0 -desktop "New Desktop" -rfbnoauth -restartonuserswitch N -unicodekeyboard 0 -keyboardloading n -pressmodsforkeys n -eventtap 3 -swapbuttons -rendezvous y &
"Error: Can not find the VNC server application! The server is not properly configured for VNC login."
Important parts from the client script (to be run on linux):
# note that I am redirecting stderr to stdout for simplicity
chan.exec_command("sudo /sbin/StartVNCLogin.sh " + username + " " + pw + " 2>&1")
stdout = chan.makefile('rb')
vnc_port = -1
for line in stdout:
print '... ' + line.strip('\n')
# look for a line where a port is stated
if line.find("Started Listener Thread on port") > -1:
vnc_port = int(line.rsplit(' ', 1))
print "--- The VNC Port is %d" % vnc_port
chan.close() # sever the connection; we know what we need to know
os.system("vncviewer %s:%d -Shared -Fullscreen" % (hostname, vnc_port))