# RDP FIDO for macOS — pre-beta

One package for Intel and Apple Silicon Macs. It installs three things:

- **the RDP FIDO client** — the same window as on Windows: tiles of your desktops, the SSH and Remote help
  (DeskHand) tabs, the same dialogs and settings, six interface languages, light and dark;
- **the RDP-FIDO-GATE gate for the Mac itself** — keeps Screen Sharing (VNC, port 5900) and, if you want, SSH
  closed and opens them only for an enrolled FIDO2 key;
- **the FIDO Stream host** — the Mac's screen as a low-latency stream for RDP FIDO viewers.

Version 1.28.2, pre-beta. So far the build has been checked on one Mac (Intel, macOS 12). If you have Apple Silicon,
macOS 13–15 or another security key, install the package and tell us how it went:
<https://new-imobile.com/contact>.

Russian: [README.ru.md](README.ru.md).

## What you need

- macOS 10.15 or later (checked on macOS 12), an Intel or Apple Silicon Mac;
- a FIDO2 security key over USB (YubiKey and others);
- for RDP: Microsoft's free **Windows App** from the App Store (formerly Microsoft Remote Desktop) or FreeRDP
  (`brew install freerdp`) — the client uses whichever is installed;
- on the machines you connect to: the RDP-FIDO-GATE gate for Windows or Linux; the Free edition is enough.

## Installing

1. Download [rdpfido-1.28.2-macos.pkg](rdpfido-1.28.2-macos.pkg) and check it against [SHA256SUMS](SHA256SUMS):
   `shasum -a 256 ~/Downloads/rdpfido-1.28.2-macos.pkg`.
2. The package is not signed with an Apple Developer ID yet, so macOS refuses a double click.
   - macOS 14 and earlier: Control-click (or right-click) → Open → Open.
   - macOS 15 and later: try to open the package once, then System Settings → Privacy & Security → Open Anyway
     at the bottom.
   - Or in Terminal: `sudo installer -pkg ~/Downloads/rdpfido-1.28.2-macos.pkg -target /`.
3. The package puts the **RDP FIDO** app in Applications and the gate, the stream host, the command line and the
   stream viewer in `/usr/local/rdpfido`. The gate does not switch itself on: it guards the Mac only after `setup`
   (below).

To update, install the newer package over it; sessions, keys and settings stay.

## The client: connecting to Windows or Linux

1. Open RDP FIDO from Applications. The window and the steps are those of the Windows client.
2. Add → the machine's address and user name → Enroll key… → the code the gate on that machine shows
   (`RdpFidoGate.exe code` on Windows, `sudo rdpfido-gate code` on Linux) → touch the key.
3. Click the tile → touch the key → connected. The session's properties choose its kind: RDP (Windows App or
   FreeRDP), FIDO Stream (our viewer with VideoToolbox hardware decoding) or SSH (the console with saved commands
   and the AI assistant).

RDP passwords are kept in the macOS keychain. Sessions live in `~/Library/Application Support/rdpfido`, in the
Windows client's format. Command line: `/usr/local/rdpfido/bin/rdpfido help`.

The client takes the tile pictures of RDP sessions from the FreeRDP window only if Screen Recording is already
allowed for it; otherwise the tiles keep their icon.

The Remote help tab is DeskHand, remote help by code: the person you help tells you a code and you connect. It needs
a master seat in your new-imobile.com account (14 days free); see <https://new-imobile.com/en/rdp/#deskhand>.

## The gate: putting the Mac itself behind a key

1. Switch on what the gate will guard: System Settings → General → Sharing → Screen Sharing (and Remote Login if
   you want SSH).
2. In Terminal:

   ```
   sudo /usr/local/rdpfido/bin/rdpfido-gate setup
   ```

   The gate installs its launchd service, the macOS firewall allowances and a pf packet-filter rule, and shows a
   key enrollment code valid for 15 minutes. Port 5900 closes as soon as the first key is enrolled.
3. On a client (Windows, Linux, Android or another Mac): Add → this Mac's address → Enroll key… → the code. A new
   code: `sudo /usr/local/rdpfido/bin/rdpfido-gate code`.
4. SSH behind the same key: `sudo /usr/local/rdpfido/bin/rdpfido-gate ports add 22`.

State: `sudo /usr/local/rdpfido/bin/rdpfido-gate status`. Sessions already open are not cut when the port closes:
pf lets only new connections through, and only from addresses that touched a key.

## FIDO Stream from the Mac

The gate starts the stream host in the session of the user at the screen. The screen goes out as hardware H.264
straight from the screen surface, with no copying through the processor; the clipboard both ways (when the session's
parameters allow it); system sound on macOS 13 and later. On macOS 12 the stream has no system sound; the viewer's
microphone is heard on the Mac.

macOS asks the program itself for permissions, so add `/usr/local/rdpfido/bin/rdpfido-stream-host` once in
System Settings → Privacy & Security:

- Screen Recording — for the viewer to see the screen;
- Accessibility — for the viewer's mouse and keyboard.

(The "+" under the list, then Cmd+Shift+G and the path above.) To check: `/usr/local/rdpfido/bin/rdpfido-stream-host permissions`.
In a shared session (several viewers) Ctrl+Option+Shift+H on the Mac's keyboard takes control back for the person
at the Mac; a viewer cannot press it for you.

## Licence

On a Mac the client works as the Windows free edition — with the banner tile and the same limits — for the first half
year (182 days) from its first start. After that, connecting needs **RDP FIDO Pro**: one Pro purchase covers both
Windows and Mac (<https://new-imobile.com/order/rdpgate?plan=pro>). The account server keeps the date, so a reinstall
does not restart it; the Account window shows the last free day. The gate on a Mac needs no licence.

## Known limits of the pre-beta

- The package and the app are signed with our own certificate, not an Apple Developer ID, and are not notarized —
  hence the Open step when installing.
- Keys: FIDO2 keys over USB only; Touch ID does not act as a key.
- No virtual gamepad on a Mac host: a virtual HID device needs a special Apple entitlement.
- The build has been checked on an Intel Mac with macOS 12; we have not run it on Apple Silicon or macOS 13–15 yet,
  nor the host's system sound (macOS 13+).

## Uninstalling

```
sudo /usr/local/rdpfido/bin/rdpfido-gate uninstall
sudo rm -rf "/Applications/RDP FIDO.app" /usr/local/rdpfido
sudo pkgutil --forget com.imobile.rdpfido
```

The gate's keys and settings stay in `/Library/Application Support/rdpfido-gate` and the client's sessions in
`~/Library/Application Support/rdpfido`; delete those folders to forget them.

Third-party components (OpenSSL, libfido2, libcbor, SDL2, FFmpeg, openh264) and their licences are in
`/usr/local/rdpfido/licenses`.