Mac / iPad – best method for key-based authentication?

[marcsnyder]

Good day all.  I just downloaded NoMachine after looking for a way to control my Mac mini while I’m away from the house using my iPad.

I use WG to VPN into my home router / firewall when I’m away.

I (think) I’d like to accomplish the following:

• create / use a key pair between my iPad and my Mac mini – I’m figuring that would be more secure than a username / password?
• I would also like to prevent the NoMachine server on my Mac from registering / publishing my Mac on the NoMachine cloud.  I’ll plan on just VPNing in and accessing my Mac via IP address (I use DHCP reservation on this Mac)
• and finally, just b/c I’m paranoid 🙂 I’d like to restrict inbound connections to an IP range used by my firewall when connecting in via WireGuard.  I know I can do that in PF on the Mac – but wasn’t sure if that was the best / most elegant solution

thanks so much!

[Britgirl]

create / use a key pair between my iPad and my Mac mini – I’m figuring that would be more secure than a username / password?

Hi, for key-based authentication take a look at the article here which explains how to set it up: https://kb.nomachine.com/AR02L00785.

I would also like to prevent the NoMachine server on my Mac from registering / publishing my Mac on the NoMachine cloud.  I’ll plan on just VPNing in and accessing my Mac via IP address (I use DHCP reservation on this Mac)

NoMachine does not automatically register/publish a machine on Network unless you or a user with full admin privileges explicitly tell it to 🙂 But if you want to make sure it doesn’t accidentally get published for whatever reason, you can disable it completely in the configuration file and to do that, check this article here: kb.nomachine.com/AR06W01278.

and finally, just b/c I’m paranoid I’d like to restrict inbound connections to an IP range used by my firewall when connecting in via WireGuard.  I know I can do that in PF on the Mac – but wasn’t sure if that was the best / most elegant solution

To restrict an incoming over IP connection to a specific range, you can do using your router/firewall configuration. What is possible within the server configuration file is to lock down which interface the nx server daemon is listening. You can do this with NXdListenAddress in the server.cfg file. It does not accept a range of addresses currently, that’s coming in version 10. You can also prevent the machine from broadcasting on LAN, it will still be reachable through creating a connection, but it won’t show up in other NoMachine users’ Machines panel if they are also on your same LAN.

#
# Enable or disable broadcasting the required information to let
# other computers discover this host on the local network.
#
# 1: Enabled. Other computers on the local network can find
#    this host machine.
#
# 0: Disabled. This computer cannot be found on the local
#    network but it’s still reachable by providing its IP
#    or hostname.
#
EnableLocalNetworkBroadcast 0

[Author]

Posts