codnamacs blog
Practical writing about secure Mac remote access, VNC over SSH, SSH hardening, firewall lockdown, and owning the path to your machines.
Start here
A central map for VNC over SSH, VNC lockdown, Tailscale compatibility, SSH hardening, and platform guides.
Glossary
Definitions, keywords, and original phrases for VNC over SSH, localhost, authorized_keys, Per-Key Limits, ML-KEM, VNC Lockdown, and Mac mini remote access.
VShell is a serious enterprise SSH and secure file-transfer server, and it runs on macOS too. HearthGate is the Mac-native gateway around Apple Screen Sharing: SSH-gated, key-restricted, logged, and revocable. Here is how they differ, what the price gap really means, and who each one fits.
Read noteA pop-culture security story about Independence Day, the famous Mac virus scene, trusted alien craft, old keys, revocation, and why Per-Key Limits matter.
Read noteA cyberpunk manga-style web story about a signal, a tunnel, a gate, and the moment secure access becomes respect.
Read noteFrom creative studios and Mac mini homelabs to local AI boxes, consultants, education labs, and small IT teams: these are the scenarios where a secure Mac gateway matters.
Read noteA security-first guide for running OpenClaw on a Mac mini: protect the Mac access path first, keep the gateway local, then install the agent stack.
Read noteTailscale is excellent at making private devices reachable. HearthGate solves the next Mac-specific question: what happens on the host after it is reached?
Read notePort 5900 is convenient for VNC, but convenience is not the same thing as a safe remote-access boundary. Here is why the screen port should stay behind SSH.
Read noteCloud relays are convenient, but they also move trust away from the Mac you own. A self-hosted path keeps the connection model under your control.
Read noteVNC over SSH gives macOS Screen Sharing a stronger outer layer: key-based access first, screen access second.
Read noteWhen VNC is protected behind SSH, localhost is not a placeholder. It is the address that keeps the screen service behind the tunnel.
Read noteApple gives macOS users Screen Sharing and OpenSSH, but secure, shareable, auditable access still needs a model around those parts.
Read noteTightVNC can be part of a secure Mac remote-access workflow when the VNC session travels through an SSH tunnel instead of reaching port 5900 directly.
Read noteMobaXterm can connect to a Mac screen through SSH when the tunnel and the VNC target are kept separate.
Read noteA Mac remote-access gateway should treat SSH as a carefully managed entry point: keys, ports, bindings, login policy, timeouts, and cleanup all matter.
Read notePost-quantum-ready SSH is not a magic shield. It is a practical way to use hybrid key exchange when the installed SSH stack supports it.
Read noteCloud remote desktop and self-hosted Mac access solve different problems. The right choice depends on control, convenience, compliance, and who owns the path.
Read note