> For the complete documentation index, see [llms.txt](https://doc.flow.swiss/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doc.flow.swiss/products/mac-bare-metal/devices.md).

# Devices

Mac Bare Metal devices are genuine, dedicated Apple Mac devices that are delivered with the latest stable macOS version. They can be provisioned on-demand in a few steps.

## Quickstart

1. Start by clicking the **Wizard** button in the [Control Panel](https://my.flow.swiss). Click **Create Device** in the Mac Bare Metal ta&#x62;**.**<br>
2. Name your device.<br>
3. Choose the configuration (flavor) for your device that determines its Apple Mac platform (Intel or Apple Silicon), Processor cores, Memory, Storage, and price.<br>
4. Confirm the network topology. By default, each device is assigned an [Elastic IP](#user-content-fn-1)[^1] address and is reachable via the Internet. If you wish for the device to be reachable only internally, uncheck the **IPv4** checkbox.<br>
5. Specify a password for the default user who has root privileges. The default user is named "Flow". Click **Finish**. Deploying a device takes a few seconds.<br>
6. Once the device is created, follow the detailed guides on how to connect to the device via [Remote Desktop](/products/mac-bare-metal/how-to/connect-via-remote-desktop.md) or [SSH](/products/mac-bare-metal/how-to/connect-via-ssh.md).

## Important to know

* Billing of Mac devices also takes place when the **device is turned off**. A device in a stopped state continues to reserve the dedicated Mac device, and therefore charges incur until you delete it.<br>
* For security reasons, only two TCP ports are open from the outside. These are ports 5900 (VNC) and 22 (SSH). The port settings can be restricted or extended in the Control Panel via Mac Bare Metal > Networking > Security Groups > Default.

## **Security recommendations**

A device with an Elastic IP address is directly reachable from the Internet. We strongly recommend the following measures:<br>

* **Restrict the open ports to known source IP addresses.** In **Mac Bare Metal > Networking > Security Groups > Default**, limit ports 5900 (VNC) and 22 (SSH) to the IP addresses or ranges you actually connect from, for example your office or VPN exit IP. Leaving VNC open to the entire Internet is the single largest risk factor for a hosted Mac.
* **If you have no fixed source IP address**, do not open port 5900 to the Internet. Instead, connect through a VPN or a jump host, or use a remote desktop tool that does not require an inbound port, such as AnyDesk.
* **Keep macOS up to date.** Install security updates promptly and enable automatic updates. Screen Sharing in particular has been affected by a critical authentication bypass (CVE-2026-65400), fixed in macOS 14.8.9, 15.7.9 and 26.6.1. Devices that are exposed to the Internet and not up to date can be compromised without any credentials.
* **Use strong credentials.** Choose a strong password for the default user "Flow", and prefer SSH key authentication over password authentication for port 22.
* **Disable services you do not need.** If you only work via SSH, turn off Screen Sharing under **System Settings > General > Sharing** and remove port 5900 from the security group.

[^1]: Publicly-accessible static IP address