How to: Remotely control another Mac

Discussion in 'macOS' started by beaster, Apr 28, 2005.

  1. beaster macrumors member

    beaster

    Joined:
    Jan 19, 2005
    #1
    I decided to put together his how-to after reading the Switching my Granddad thread and figuring there are probably a number of others out there who serve as the de facto tech support person for friends and family in remote locations. The idea is to be able to remotely view and, if needed, control another Mac to help teach a new Mac user how to do something or fix their problem.

    This isn't the fastest thing in the world mind you (anything they do with much in the way of graphics, like iPhoto, takes a long time to paint on my end), but it definitely works well enough for what I need. My method certainly isn't the only way of doing it, but it meets my criteria, which are:
    • secure - didn't want to pass anything in the clear over the internet.
    • free - I'm sure that Timbuktu and Apple Remote Desktop (ARD) Server are great products, but what can I say, I'm a cheap bastard.
    • built-in - I always prefer to use as many standard built-in tools as possible to keep things simple.
    • simple - wanted point-and-click simplicity on my dad's end. Didn't want him typing in IP addresses and such.
    • zero or at least minimal network changes on Dad's end - didn't want to have him mucking around with his router and end up hosing himself so that he can't get online anymore since I can't fix that sort of thing remotely.

    [For the purposes of this how-to, the Mini is my dad's computer, and the powerbook is my computer - should help keep things straight as far as which computer needs to do what. I had Apple ship the Mini to me directly so I could set this up in advance, but the same could probably be done remotely without too much pain.]

    So, the first thing I did was upgrade his Mac to the latest ARD client software. This is free on the Apple site:

    http://www.apple.com/support/downloads/appleremotedesktop21client.html

    It's called the ARD client, but in truth it's really a VNC server under the sheets. I had the luxury of being able to do this myself since I had his Mini at the time, but it's really pretty easy and I'm confident I could have talked my dad through the install over the phone.

    Once that was installed I went into the Sharing prefrences pane on the Mini and started the ARD service. I also went into the Access Privileges for ARD and enabled "VNC viewers may control screen with Password". Just put any old password in - it doesn't matter and will be ignored since we're tunneling over ssh. I also put a check next to his user account and checked "Observe" and "Control" (not actually sure if this is necessary, but whatever). Note that I did NOT need to open up the ssh ports on the Mini or the Mini's router since the Mini is sending the ssh request outbound (it's a reverse tunnel), not receiving ssh requests inbound. Also I did not need to open up the ARD port (5900) on the Mini's router; however OSX will automatically open ARD ports on the built-in software firewall when you start the ARD service. Technically you can close these ports down on the Apple firewall since the traffic is tunneled over ssh, but that's beyond the scope of this project.

    Next I enabled Remote Login (i.e. ssh server) on my Powerbook. I created a dummy, non-priveleged account (called "dummy") to receive the tunnel. I generated a DSA public-private key pair on the Mini under my dad's account (in Terminal, type "ssh-keygen -t dsa" and accept the defaults). I copied my dad's public key to the ~/.ssh/authorized_keys2 file under the dummy account. This step isn't really necessary if you don't mind your switcher having to remember and type in the dummy user's password, but that didn't meet my "simple" criterion above. Again I had the luxury of doing this work directly on the Mini, but with iChat and a little cutting and pasting, it can be done remotely as well. Note there's no real security risk having your switcher email or IM you their public key - that's why it's "public".

    Next I installed Chicken of the VNC on my Powerbook (http://sourceforge.net/projects/cotvnc/). I assume any decent Mac VNC client would do, but COTVNC was lightweight, free, and worked out of the box with no changes. I also setup a DDNS name for my Powerbook using http://www.dyndns.org/ (again, free). This allows me to hard-code a name instead of an IP on the Mini since my ISP uses DHCP and the IP might change over time. There are various DDNS clients for Mac - I have no experience with them since my Linksys WRT54G router has DDNS support built-in.

    I then created a saved Terminal file on the Mini to launch the reverse tunnel. In Terminal just do a File -> Save As then give the file a name. Click on "Execute this command" and enter the following:

    ssh dummy@mypowerbook.ddnsname.whatever -R 5900:127.0.0.1:5900

    then check "Execute command in shell" and click save. This creates a reverse (hence the -R) tunnel mapping the VNC client port (5900) on my powerbook to the VNC server port (also 5900) on his Mini. It's a reverse tunnel meaning that although he established the connection from the Mini to the Powerbook, the "flow" or the port mapping actually goes in the opposite direction - from the PB to the Mini. Why all the trouble? This means that my dad didn't have to screw around with opening up any ports on his Mac firewall or do any port re-mapping on his router to allow inbound ssh connections. The tunnel eminates from his box but allows me to go back into his. Now all my dad has to do when he wants to establish the tunnel is double-click on the saved terminal file. Magic! :)

    Now since I too am behind a NAT router and run the Mac firewall, I did have to map the ssh port (22) on my router to my Powerbook, and I did have to open up the ssh port on the Mac Firewall. But I can turn all this off when the tunnel isn't in use for better security (which is easy since it's on my end, not my dad's). And for the truly paranoid you can turn off the ability for password-based ssh authentication (assuming you setup the public-private key pair) so that there's little chance you could be hacked via a password attack.

    Almost there! Now all my dad has to do was double-click on that Terminal file to startup the tunnel. Once that is established, I fire up COTVNC, type in "localhost" under the Host: field, leave the display/port set to 0, leave the password field empty, and click Connect. Voila! The Mini's screen appears and I can use my mouse and keyboard to control it. Note that I do NOT need to be logged in as the dummy user. The whole point of the dummy user is to be the end point for the tunnel. Once the tunnel is up, the ports are mapped for the whole machine - any user on the powerbook can take advantage of the tunnel. Also note that with this method I never need to know the IP address of the Mini - again, for the sake of simplicity I didn't want my dad trying to figure out his router's IP address everytime we start the tunnel.

    That's about it. Hope others find this useful. Nothing here is really anything new - just cobbled together a bunch of different pieces into a single solution, and I'm sure I'm not the first to do so.

    Regards,
    Sean
     
  2. arn macrumors god

    arn

    Staff Member

    Joined:
    Apr 9, 2001
    #2
    a bit complicated... but sounds like the solution is great. (stickied this for now)

    thanks
    arn
     
  3. sparkleytone macrumors 68020

    sparkleytone

    Joined:
    Oct 28, 2001
    Location:
    Greensboro, NC
    #3
    After looking around my Terminal, i was pretty amazed that OS X doesn't come with stunnel. This makes it really easy to create ssh tunnels for insecure ports.

    For other people who want to do something like this, I would recommend building a binary with OpenDarwin and using it on all the controlled machines to tunnel a port to 5900.
     
  4. Rubin421 macrumors member

    Joined:
    Dec 24, 2004
    Location:
    New York
    #4
    I just use VNC, and it allows me to control or be controlled by a Mac or a PC, under Mac OS, Mac OSX, Windows 95, 98, 2000, XP..., Linux, SunOS.... Almost every OS!
    And it seems much simpler than your solution: you just install VNC, and the host launches the server app while the guest launches the viewer. All you need is the host's IP and a password, and that's it.
    www.realvnc.com
     
  5. beaster thread starter macrumors member

    beaster

    Joined:
    Jan 19, 2005
    #5
    Actually, we're both using VNC. ARD is basically a VNC front end. COTVNC is a VNC viewer. The only difference is that I'm tunneling my VNC connection via SSH so that it's secure and so that there's no need to muck around with IP addresses and ports on my dad's computer/router. I could also set this up to work on any other OS with VNC support, but that was beyond the scope of my needs (and therefore my post). The point is, my method meets my criteria, whereas a straight-up VNC setup does not. That doesn't mean your method is any better or worse, it just means it doesn't work for what I wanted. As I said in the original post, there's certainly more than one way to skin this cat.

    Regards,
    Sean
     
  6. beaster thread starter macrumors member

    beaster

    Joined:
    Jan 19, 2005
    #6

    Cool, thx. Agreed, it's a bit complicated to setup. I'm certainly open to suggestions or improvements, as long as my established criteria are still met - the OpenDarwin binary idea sounds like a good path.

    Regards,
    Sean
     
  7. cmcclain macrumors newbie

    Joined:
    May 26, 2004
    Location:
    Florida
    #7
    Controlling MAC's in different cities?

    I have been trying this, but not sure if possible. I have a licensed copy of Apple Remote Desktop 2.1. My sister in-law bought my old iMac, she is new to Apple and she is frequently asking for my assistance. It's a pain trying to teach her things and show her stuff over iChat. I want to be able to control her home computer (with her permission of course) from my computer at my house. We both have BroadBand Cable internet. I will soon be using Tiger and she is still using Jaguar. Is this possible to control her computer via the internet for FREE? If matters, I am connected wirelessly through AirPort Express and she is connected directly through the cable modem (ethernet). I am sorry this may be long and drawn out, but I would greatly appreciate it if someone could held me out. Thanks, Colby.

    You can E-mail me, (cmcclain@tampabay.rr.com) or iChat me, (citrusgoofy)
     
  8. sososowhat macrumors 6502

    Joined:
    Feb 20, 2003
    Location:
    Palo Alto, CA
    #8
    Thank you!

    Beaster, thank you for this! I've been supporting my 78 year ole' dad & his mini & this will come in mighty handy. You can imagine what walking him through changes over the phone (or even over the isight) is like when he calls a browser a "server" half the time, and he confounds hotmail with "the internet".
     
  9. beaster thread starter macrumors member

    beaster

    Joined:
    Jan 19, 2005
    #9
    You're welcome, good luck with it - I know EXACTLY what you're talking about, which is what prompted me to set this up. Like the time he emailed me to tell me that his email wasn't working... ;)

    -Sean
     
  10. Chimpan-A macrumors newbie

    Joined:
    Mar 1, 2005
    Location:
    New Zealand
    #10
    Minimum Network Speed?

    Hey,

    I was wondering if you need a broadband connection for these VNC type arrangments.

    I have a broadband connection, but the family member that I am technical support for only has a 56k dial up modem.

    Will it work over dial up, or will it be too slow to function?

    cheers

    -Chimpan-A
     
  11. ebuc macrumors regular

    Joined:
    Aug 5, 2003
    Location:
    Nor'East
    #11
    Does this work with a proxy running?

    Will this work if the "PowerBook" has almost all ports blocked due to a proxy. The only port open on my internet connection now that I now of is port 80. So, can this method of controlling a computer be done through port 80?

    (A little off-topic, but assuming I got this working, what would be the easy way to transfer files from the "Mac mini" to my "PowerBook")
     
  12. beaster thread starter macrumors member

    beaster

    Joined:
    Jan 19, 2005
    #12
    Sounds like your "powerbook" is behind a firewall (at work maybe?) that blocks all but http (port 80) traffic? If so, then the above steps won't work. The port that needs to be open is inbound port 22 (ssh) on the "powerbook" side. Although it is possible to run ssh on a different port, I don't think that'd help your situation.

    VNC doesn't allow for file transfer between the machines, as far as I know. But if you can ssh between the boxes, you can sftp, and you'd be all set. You might also be able to setup ssh tunnels for other protocols, like Apple File Sharing, etc., but I haven't tried that.

    -Sean
     
  13. beaster thread starter macrumors member

    beaster

    Joined:
    Jan 19, 2005
    #13

    I haven't tried it over a phone line, but given that it's not the fastest thing over broadband, I'd assume 56k would be painful.

    -Sean
     
  14. wPod macrumors 68000

    wPod

    Joined:
    Aug 19, 2003
    Location:
    Denver, CO
    #14
    this sounds like a good solution. yes there are 'easier' ways if you can grab the IP address, but having the remote user do this is often way more complicated or dangerous than anything else!!! my grandparents are thinking about getting a mini and if they do, ill buy it for them and set this up so i can help them out if needed!
     
  15. ebuc macrumors regular

    Joined:
    Aug 5, 2003
    Location:
    Nor'East
    #15
    Thanks for the suggestions; I'll give them a try.

    I believe all these problems would be changed if I could just set up a VPN at my home computer, but I haven't been able to find any free VPN Server anywhere.
     
  16. MacTruck macrumors 65816

    MacTruck

    Joined:
    Jan 27, 2005
    Location:
    One Endless Loop
    #16
    I just installed synergy on both my powerbooks and it rocks. Its basically a software KVM switch but its really like having a dual processor system. I have 2 Dell 24" flat panels side by side and the powerbooks are hooked up to each of them and I can move my mouse between both monitors and the keyboard works as well. Then I networked the two together and its just like having a dual system with a 160gb hard drive. Love love love it. I first tried teleport but it sucked. Try it, you'll love it if you have more than one mac.
     
  17. ruftytufty macrumors member

    Joined:
    Jan 4, 2005
    Location:
    Berkeley, CA
    #17
    password problem with ARD

    This is really great - I have a couple of friends whose computers I help admin, and this will save a lot of trouble.

    I'm testing this setup using two computers (call them "Master" and "Slave") on my home network before I try deploying it on their computer, and I ran into one thing that didn't work quite as expected:

    When I connect w/COTVNC, if I do not enter the password that was entered in ARD setup (on the VNC viewers may control screen with password _____ line), the connection fails. ARD setup requires that the password be non-blank. I believe I'm going through the ssh tunnel, since I'm using localhost as the host in COTVNC, so I think everything should look the same as your setup as far as ARD and COTVNC are concerned, even though I'm doing this on a local network.
    The only difference I know of from your setup is that I'm using ARD 2.2 (the current version) rather than 2.1. Any ideas on what I might be doing wrong?

    Thanks!
     
  18. ruftytufty macrumors member

    Joined:
    Jan 4, 2005
    Location:
    Berkeley, CA
    #18
    ssh asks for passphrase

    one more thing ...

    when I run the ssh command to create the tunnel on the "Slave" machine, I always get

    "Enter passphrase for key '/Users/philip/.ssh/id_dsa':"

    I did use a passphrase when I generated the key pair. Should I have left this blank? If not, is there some way to store the passphrase so the user doesn't have to enter it each time?
     
  19. beaster thread starter macrumors member

    beaster

    Joined:
    Jan 19, 2005
    #19

    Sounds like you've got it right. The difference is ARD 2.2. I just yesterday upgraded my wife's eMac (affectionately known as the Guinea Pig) to ARD 2.2, and found the same behavior you describe - that it now enforces password. So if you're on ARD 2.1, the password isn't enforced; if you're on ARD 2.2, then your VNC client has to provide the same password you have setup in ARD on the target box. So sounds like you've got it working - you should be all set!

    -Sean
     
  20. beaster thread starter macrumors member

    beaster

    Joined:
    Jan 19, 2005
    #20
    If you leave it blank (just hit return), then the passphrase is null and the user won't have to enter anything. I actually set mine up with a passphrase, mostly out of paranoia. The passphrase ensures that only someone who knows the passphrase has the ability ssh into the master, as opposed to any ol' person who happens to have access to the slave Mac. You can change/remove the passphrase from an existing key with the "-p" flag in ssh-keygen, but you'll want to read the man page to get the syntax right.

    -Sean
     
  21. mileslong macrumors 6502

    mileslong

    Joined:
    Apr 29, 2005
    Location:
    Newport Beach, CA
    #21
    i simply use mind control techniques when i want to take over other peoples macs...maybe im taking over yours right now... :eek:
     
  22. arkmannj macrumors 65816

    arkmannj

    Joined:
    Oct 1, 2003
    Location:
    UT
    #22
    Reverse VNC

    Here's a solution, although it requires your family member/client to know your IP address (that can be fixed with a dynamic DNS I guess so you could have them enter in help.mydomain.com instead of 123.###.###.###)

    another option besides dynamic DNS if your IP doesn't change much is to edit their hosts file. to point to your IP. then just update it on occasion as your IP changes.

    http://www.tinyapps.org/vnc/
    http://www.ozonehouse.com/mark/blog/code/Reverse_VNC.html

    Hope that makes since...
    Shorah b'shemtee,
    arkmannj
     
  23. beaster thread starter macrumors member

    beaster

    Joined:
    Jan 19, 2005
    #23
    Yep, that certainly works. However, to meet the criteria I established in the original post, this method falls short (not encryted, doesn't leverage built-in software like ARD). Again, not to say it's better or worse, just doesn't meet my personal criteria.

    Thanks,
    Sean
     
  24. swheeler macrumors member

    Joined:
    May 30, 2005
    #24
    Is ther any way I can access my VNC server from a public computer that won't let me install apps? Like some kind of web interface or something? Doesn't have to be secure, just has to work.
     
  25. 40167 macrumors regular

    Joined:
    Sep 5, 2004
    #25
    Sure, you can put a java client on the system (run apache locally on the computer running vnc, as simply putting it on geocities wont work)... theres an example in my signature.
     

Share This Page