Accessing your Mac server via VNC over SSH

Public VNC (port 5900) is a magnet for brute-force scanners, and macOS Screen Sharing falls back to plain unencrypted VNC against non-Apple clients. The clean solution is to tunnel VNC through SSH and close 5900 to the world.

This works with the SSH server built into macOS. No extra software on the server.

How it works

Your local machine forwards a chosen local port (say 12345) over SSH to port 5900 on the Mac. Your VNC client connects to localhost:12345. All traffic rides inside the encrypted SSH tunnel.

Step 1 — open the tunnel

ssh -L 12345:localhost:5900 youruser@your.server.ip

Leave that terminal open.

Step 2 — connect with Screen Sharing

In Finder press ⌘K and enter:

vnc://localhost:12345

Log in with your macOS user. Done — you're inside Screen Sharing through an encrypted tunnel.

Step 3 — block VNC publicly

Once the tunnel works, drop port 5900 in your firewall (see Firewall guide). Restrict SSH (22) to a small set of source IPs and your management surface is no longer reachable from the open internet.

Tips

• Add an entry to ~/.ssh/config so you can run a single command:

  Host vboxx
    HostName your.server.ip
    User youruser
    LocalForward 12345 localhost:5900
  

• For unattended sessions, combine with autossh to auto-reconnect.
• If macOS asks you to re-trust the host key after a reinstall, that's expected.