Apple 3 manual Command-Line SSH Access, Managing Client Administration Settings and Privileges

68

To allow VNC access:

1On the client computer, open System Preferences and click Sharing.

If prompted, enter the user name and password of a user with administrator privileges on that computer.

2Select Apple Remote Desktop in the Sharing pane.

3Click Access Privileges.

4Select “VNC viewers may control screen with password.”

5Enter a VNC password.

Warning: Do not use the same password as any local user or Apple Remote Desktop login.

Command-Line SSH Access

Command-line SSH access is not granted or managed using Remote Desktop. This type of access is managed in the Sharing pane of System Preferences (called “Remote Login”) and is separate from Apple Remote Desktop access types. When you log in to a client remotely using SSH, you have the user privileges assigned to the user name and password. These may or may not include computer administrator privileges.

You can use SSH to access a client using a user account created for Apple Remote Desktop, but you are limited to performing whatever tasks were allowed to that user when the account was created. Conversely, only the users specified in the Apple Remote Desktop access privileges can access a computer using Apple Remote Desktop. Apple Remote Desktop privileges are completely separate and distinct from local computer administrator UNIX privileges.

Managing Client Administration Settings and Privileges

Regular audits of administration settings can help maintain a secure Remote Desktop administration environment. Using the various administrator options given with Apple Remote Desktop administrator privileges, you can create specialized logins for certain tasks, limiting potentially disruptive power of certain sub-administrators. The following section gives detailed instructions for checking the administrator privilege settings of client computers, and changing those settings.

Chapter 5 Understanding and Controlling Access Privileges