With all that in mind, you might wonder: what should I open for use and what’s safe? The answer depends on whether your Mac has a public IP address. I advise always turning on only the services you need. A few are worthwhile, and how you configure them depends on your circumstances.
But you should have different considerations under these sets of circumstances:
- Privately addressed Mac on a network in which all users are trusted: If you’re by yourself or you trust your roommate and family to not attempt to access things they shouldn’t, you can enable what you like and just configure for general safety.
- Privately addressed Mac on a network in which not all users are trusted: If you share a network with other people—which could include kids or parents who may not be as safe or honest with you as you might like—consider locking things down further and using the fewest possible services.
- Publicly addressed Mac: You need to take more care to set passwords and configure limitations, and to consider whether to leave services active all the time or only when you know you or someone you trust needs them.
- High-risk individual or group: People who believe themselves at elevated risk shouldn’t operate any services on public addresses, and should think strongly about not running them even on privately addressed networks. It’s very easy for so-called Internet of Things (IoT) or “embedded devices” to be compromised. That can include DVRs, routers, smart home gear, and more. A subverted device on your local network can have the same access as anyone else on the network.
With that in mind, here are the items in System Settings > General > Sharing worth enabling or disabling. Configuration options appear when you click the info button next to a service.
Don’t allow all users
Several services let you selectively enable them. Apple offers a choice of “Allow access for” either “All users” or “Only these users” for most services. File Sharing has more fiddly options. I recommend setting access for Screen Sharing and any service starting with Remote to Administrators (often prefilled), or, better, selecting users or groups you’ve created. This limits exposure in the case of an intrusion that doesn’t gain direct access to your macOS account.
Screen Sharing
If you have a “headless” Mac (one without a monitor) that you use for various services, or machines in different parts of a house or office that you want to access remotely, screen sharing is handy.
I recommend deselecting two options in the Computer Settings dialog:
- Anyone may request permission to control screen: There’s no reason to allow this except momentarily if you want to allow someone to request access.
- VNC viewers may control screen with password: VNC is an outdated protocol that Apple’s screen-sharing technology extends with more security and features. There’s no good reason to keep this option turned on, particularly because VNC passwords are notoriously easy to crack.
File Sharing
The File Sharing service on a Mac offers fine-grained controls to choose which folders and volumes are accessible to which people, including the type of access: read/write, read-only, or write-only (to drop items into without seeing the shared item’s contents).
In configuring File Sharing, I recommend the following:
- Disable Full Disk Access if multiple people have accounts with administrator access to the Mac, unless you explicitly want them all to have remote access to all files on the volume.
- In the Shared Folders list, select items you don’t need shared and click the minus button.
- In the Users list for each shared folder in turn, click the pop-up menu and choose No Access for users and groups that can’t be removed, then select the user or group and click the minus button to remove those that can.
What you’re left with is a limited, tightly controlled set of folders and volumes that only people you have approved can interact with.
I often create a sharing account that I set up for limited access. You can use the Guest account for this purpose, but I’d rather control it more directly by name. See also how to set up safe user accounts on a shared Mac.
Remote Login, Management and Apple Events
Apple offers powerful but somewhat obscure ways to access, manage, and use a Mac remotely:
- Remote Login lets you connect via the SSH (secure shell) protocol, commonly used in Unix/Linux, as well as access file sharing with SFTP (Secure File Transfer Protocol), which is really “FTP using SSH.” It’s rarely needed except for particular purposes, such as if you need remote command-line access. If you do enable it, keep “Allow full disk access for remote users” turned off.
- Remote Management connects with Apple Remote Desktop (ARD), a corporate and academic tool. If you’re not using ARD, don’t enable this service.
- Remote Apple Events or Remote Application Scripting is a tweaky thing that lets an AppleScript running on one Mac send control events to another. It’s rare you need this, and you will know if so.
Reaching your Mac from outside
If you want to have access to Macs and other devices that are behind NATs or other network protections, I highly recommend Tailscale. The company’s core product lets you create an account, install software on nearly any device, and then have those devices create VPN tunnels to a pooled central network space. This is a profoundly straightforward way to use File Sharing and Screen Sharing when away from your home network. You can install Tailscale on an Apple TV and then set it up to provide access to the entire network it’s on, too!
Tailscale offers a non-commercial account that fits most people’s personal needs.
