Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a macbook that I've managed to expose (using port forwarding) to the world. It works nicely but I'm worried that, while it's not pingable or otherwise detectable, it might get detected and exploited.

What are the main types of security I should look into for this? Also: would it be more (or less) secure to ONLY expose ssh instead of VNC?

share|improve this question

2 Answers 2

Ideally you'd at the router level block incoming connections to the Mac except for the specific ip address you expect to come in on.

If you want to be able to access it from anywhere, the IP address based blocking isn't going to work for you, so at that point you should come in by VPN. I use OpenVPN for this.

Otherwise, it's just the basics, including strong passwords and keeping your system patched and up to date.

Regarding whether exposing SSH is more or less secure than exposing VNC, assuming strong passwords and an up to date system, the difference is (in theory) the ability to intercept. I'm not sure what password protection implementation this particular VNC server uses. SSH is secure in this regard. So my gut feeling is SSH-only would be safer.

I think your best bet to remotely access is SSH or VPN only.

share|improve this answer
By default VNC sends keyboard input - including any passwords you might type - in the clear, so you should always wrap it in and encrypted tunnel of some sort (i.e. SSH or a VPN) when using it over the open internet. If you're doing Mac-to-Mac VNC, I believe the built in client and server can do it automatically, but I'm not sure how reliably it does so when there are firewalls in the way. –  Scott Apr 3 '11 at 8:58
up vote 1 down vote accepted

Using ssh

Shut off passwords and use only DSA (or RSA) authentication. Set it up as detailed here under "Using DSA public key authentication" (and the list includes more things).

Then disable SSH password authentication entirely, so if you don't have the right id_rsa file, you can't get in. This is detailed here.

Also change the default port for ssh. This seems silly but it's not at all. See the comments in the second link above. To actually do it, use the stuff here.

Using VNC

Do NOT use VNC from the outside. Tunnel it through SSH. This is actually pretty easy to work out.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.