rdp-cli
Fix Mac VNC authentication errors in rdp-cli
A VNC authentication error does not always mean the password is wrong. macOS Screen Sharing can use a Mac account or a separate VNC password; the client must use the matching method. rdp-cli 0.1.1 adds Apple ARD account authentication and support for Apple's RFB 003.889 greeting.
Check the Mac and client
On the remote Mac, open Sharing in System Settings (System Preferences on older macOS), enable Screen Sharing and check which users may connect. If Remote Management is already in use, check its access policy instead of changing services blindly. See Apple's Screen Sharing instructions. On the client, install 0.1.1 or newer and confirm that connect --help lists ard.
Choose the password you actually have
Mac account: use the remote Mac's account name and login password. Specify --user MAC_USER; explicit --vnc-security ard makes the choice clear. This is not an Apple Account email/password login.
Separate VNC password: use the password configured for VNC viewers, omit --user, and choose --vnc-security vnc-auth. The eight-byte classic VNC limit does not apply to ARD; ARD accepts up to 63 UTF-8 bytes in each username and password field.
Connect with a Mac account
Replace 192.0.2.20 and MAC_USER. In Bash on macOS/Linux:
IFS= read -r -s -p 'Password: ' mac_password
printf '\n'
printf '%s' "$mac_password" | rdp-cli connect --protocol vnc --host 192.0.2.20 --user MAC_USER --vnc-security ard --password-stdin
unset mac_password
In PowerShell on Windows, run from the EXE directory:
$secret = Read-Host 'Password' -AsSecureString
$savedEncoding = $OutputEncoding
try {
$OutputEncoding = [System.Text.UTF8Encoding]::new($false)
[System.Net.NetworkCredential]::new('', $secret).Password |
.\rdp-cli.exe connect --protocol vnc --host 192.0.2.20 --user MAC_USER --vnc-security ard --password-stdin
} finally {
$OutputEncoding = $savedEncoding
$secret.Dispose()
}
For a server intentionally configured for the separate VNC password, use the same password-input block but remove --user MAC_USER and replace ard with vnc-auth. Enter that separate password. Do not change the server or switch authentication automatically after an error.
Verify the connection
Read ok and data.session; substitute the returned ID for SESSION. Confirm the screenshot shows the intended Mac. To test input, use a disposable document, take a fresh observation and verify the text afterward. A successful authentication is not proof that the right desktop is usable.
For the following rdp-cli commands on Windows, use .\rdp-cli.exe in the EXE directory, or the actual absolute path.
rdp-cli status --session SESSION
rdp-cli screenshot --session SESSION --out before.png
rdp-cli watch --session SESSION --viewer window
rdp-cli watch --session SESSION --viewer web
If it still fails
| Symptom | What to check |
|---|---|
| Mac password rejected without a username | Use the Mac account route with --user and ard. |
| Separate VNC password rejected with a username | Use vnc-auth without --user. |
| Apple protocol or unsupported security error on an older client | Check the executable actually running is 0.1.1 or newer. |
| Timeout before authentication | Check the address, Screen Sharing service and TCP port, usually 5900. |
| Correct account still denied | Check the remote Mac's allowed users and account name. Read the returned error before another attempt. |
ARD protects the credential exchange but does not encrypt the desktop stream; use trusted LAN/VPN access. VNC in rdp-cli provides screen viewing and input, not RDP exchange-drive files, audio or microphone redirection. The 0.1.1 release checks covered Mac account login, screenshots, input and reconnection; they do not guarantee every Mac policy or server configuration.