ssh reverse tunnels

Question

Level 5

4,155 points

ssh reverse tunnels

Amongst a few other stalled projects of mine, one of them is trying to set up a ssh reverse tunnel.

On the ssh server machine, I type:

ssh -R40022:localhost:22 -R40445:cifs-fileserver-hostname:445 -R40548:localhost:548
-R45900:localhost:5900 user@remoteclienthostname

This sets up ssh and afp and vnc reverse tunnels to the ssh server machine, and presumably would set up a cifs reverse tunnel to a different machine (cifs fileserver) on the same internal network as the ssh/afp/vnc server.

So that way, on the remote client, I can ssh -p40022 localhost and have a shell session on the ssh server, or I can Finder ⌘k to afp://localhost:40548 and have a remote afp mount of the ssh server machine on the remote client, or I can Finder ⌘k to vnc://localhost:45900 and have a screen sharing session of the ssh server machine on my remote client. These all work no problem.

What's not working is getting to the cifs server machine via Finder ⌘k to cifs://localhost:40445. I get a splash screen that says "server localhost is available on my computer so access volumes and files locally."

I know that on the ssh server machine, when I Finder ⌘k to cifs://local-fileserver-host-name, it is talking to the fileserver's port 445, coz' I tcpdumped it when I was figuring out what ports needed to be reverse tunneled. Neither hostname nor numeric IP address in the -R40445:fileserver:445 piece results in any change of behavior.

So can't quite figure out why I can't get to the fileserver machine via the reverse tunnel. Anybody got any good ideas?

2008 Mac Pro (10.6.4), 2008 MacBook aluminum (10.6.4), 2007 iMac (10.6.4), 2001 Quicksilver (10.5.8), and 2004 iMac G5 (10.5.8)

Posted on Aug 25, 2010 10:34 AM

Reply

Answer 1

Camelot

Level 9

58,959 points

Aug 25, 2010 1:58 PM in response to j.v.

First off, I think you're using your switches wrong. If you're attempting what I think you are, you should be using -L, not -R

I'm not sure, though, since you may be mixing ssh 'server' and 'client' terminology, so I'm going to leave that one alone for now.

Either way that isn't the root cause of your specific question.

What's not working is getting to the cifs server machine via Finder ⌘k to cifs://localhost:40445. I get a splash screen that says "server localhost is available on my computer so access volumes and files locally."

The Finder is too smart for you. It's looking at the address you entered, recognized it as localhost and refuses to initiate the network connection (there's no point in using a network connection to get to a sharepoint on your own machine - just go to the sharepoint directly).

Therefore it's completely ignoring your SSH tunnel and telling you that you can't use CIFS (or AFP) to a local sharepoint/server. It has no idea that the port in question is ultimately forwarded off somewhere else.

Off hand I only have one possible solution for this. It's possible that the sanity check is only looking for 'localhost' or 127.0.0.1 so if you setup the forwarded port on your actual IP address rather than localhost, that might work.

For example, if your machine has the address 192.168.1.2 then:

ssh -R :192.168.1.2:40022:cifs-fileserver-hostname: 445 remoteserver

then, on the server, you may be able to ⌘k to cifs://192.168.1.2:40022/
This might bypass the Finder's sanity check and initiate the connection.

In other words, this plan sets up the port forwarding on a specific IP address bound to the server, rather than to localhost which is the default. The docs do say this will only work if GatewayPorts are enabled in sshd_config.

Reply

Answer 2

j.v. Author

Level 5

4,155 points

Aug 25, 2010 5:29 PM in response to Camelot

Hi Camelot, thanks for the reply. Just to clarify my situation, since I didn't do a very good job of that, I have a computer that sits behind a firewall, that I don't manage, that I cannot ssh into, much less tunnel other services, because it sits behind a firewall. So I am, indeed, wanting to set up reverse tunnels so that the machine to which I ultimately want to connect establishes an ssh connection to the machine from which I want to connect.

It is a little unusual in that I don't have an intermediary ssh server to which connect with the reverse tunnels, and I don't quite have the launchd.plist working quite right yet to set up this unattended ssh connection from the "target" machine at a specified time of day on a specified day of the week.

Lest anyone else decide to weigh in here and play morals cop and question my trying to circumvent firewalls, blah blah blah, I used to use VPN until last month when I.T. team did something to break VPN for all dozen or so of us Mac users. I.T. is under no obligation to provide Mac support and they have upper management direction to not provide Mac support, only Windows support. So since they don't have to, they don't. Their solution, as with upper upper management's solution, is "Get a Dell." Plus, I don't think that they know how to, anyways, otherwise, they wouldn't have dorked up the VPN. And no, they won't open inbound port 22. They don't like all the script kiddie attacks on port 22. Meanwhile, I have a need to connect so I'm trying to get an acceptably secure way to do so, with PKA ssh 2 reverse tunneled via a launchd-controlled shell script.

Anyways, it is just very odd that, like I said in my initial post, with -R40548:localhost:548 on the firewalled machine, I can ⌘k afp://localhost:10548 and mount the machine behind the firewall as a share. And it is odd that with the -R45900:localhost:5900 on the firewalled machine, I can ⌘k vnc://localhost:5900 and control the screen of the computer behind the firewall. But with -R10445:cifsshare:445 on the firewalled machine, cifs://localhost:10445 is telling me to go pound sand. I probably ought to see if I can afp to another machine via reverse tunnel, to eliminate the possibility of the non-localhost specification in the -R switch.

Reply

Answer 3

j.v. Author

Level 5

4,155 points

Aug 25, 2010 6:21 PM in response to j.v.

Kinda had to leave my long-winded post prematurely, so I didn't get to say (but wanted to) that the GatewayPorts parameter in sshd_config would seem to be a viable explanation as to why the connection is not being set up. Whose sshd_config do you think I should change, the guy's behind the firewall or the guy's outside the firewall, to whom I am attempting to ⌘k cifs://localhost:40445?

Reply

Answer 4

j.v. Author

Level 5

4,155 points

Aug 27, 2010 8:44 AM in response to j.v.

Another frustrating wrinkle.
Both machines inside the firewall.
Desktop has GatewayPorts yes.
Laptop sets up ssh connection in usual way to desktop with "-L" not "-R," i.e.:

ssh - L40445:cifs-server:445:localhost jv@desktop

From laptop (remember, now also inside firewall), first check Finder ⌘k cifs://cifs-server (make sure that I can mount the share in the usual way -- i.e., that it is indeed available). Success.
Next, check Finder ⌘k cifs://cifs-server:445 (make sure I really am talking on the port that I think I'm talking on). Success.
Finally, try Finder ⌘k cifs://localhost:40445. Crash and freqin' burn. I think it's time to quit flogging this dead horse.

My next brilliant idea: as part of a launchd-controlled script to establish the ssh connection with reverse tunnels from the desktop inside the firewall to the laptop when outside the firewall, just prior to invoking the ssh –R command, I'm thinking that maybe one could first mount the cifs server with mount point somewhere within $HOME on the desktop, so that maybe it could be accessed by merely navigating to the mount point in the afp://localhost:40548 tunnel. Maybe... But I can't quite decrypt the man mount page in order to figure out how to syntax the command, though -- how would one properly syntax the mount command to mount a cifs file server and define the mount point location?

Reply