Set up SSH Tunneling

I am new to setting up SSH tunneling on my Mac server. I understand the idea behind tunneling but how would I go about setting it up, on both my client Mac and server Mac? I am running Mavericks Server on my Mac btw.
Thanks!

I'm going to infer that you're (also) not familiar with VPNs in the following.
Generic sequence: open up the necessary ports and protocols at your firewall for tunnel or VPN pass-through, and configure the tunnel or VPN server, and configure the VPN or tunnel client.  
Here's a list of the ports, and make sure you distinguish TCP ports, UDP ports, and protocols; those three are all different, when you're configuring a firewall. 
ssh uses TCP port 22 by default, though other ports can be selected.
With OS X and OS X Server, L2TP via IPSec and PPTP VPN clients and servers are available, and are very common choices.
Or yes, you can go old-school, and use ssh tunneling if you really want to.  There's an overview of that process here. 
If you're into using the command line (I happen to be), then straight ssh (and sometimes ssh tunneling) can be handy, but most folks with OS X will probably want to use an L2TP VPN — I use that regularly, too.  Based on the way you're asking this question, I'd probably guess you'll want to use L2TP/IPSec via NAT VPN passthrough in whatever box you're using as a gateway, and skip the ssh tunneling for now.  (This configuration and this approach would be more common than ssh tunneling in general, though there are cases where you might want or need to use ssh tunneling or some other alternaitve to L2TP/IPSec.)

Similar Messages

  • Ssh tunnel mode on Leopard does not work

    Hi folks,
    I have set up ssh tunnel mode (tunnels opened with "ssh -w 0:0 ..." makes SSH create the necessary tunX interfaces on its own) from my linux boxes to certain servers, and it works well.
    But using "ssh -w 0:0" on Leopard client leads to
    debug1: systunopen: /dev/tun0 open failed: No such file or directory<<</div>
    So it seems - although the ssh man page describes it thus - that creating tun interfaces on Leopard does not work.
    By the way, omitting the interface numbers for the tun interfaces on both sides ("ssh -w" instead of "ssh -w 0:0") leads to "Bad tun device" although that as well is documented in the ssh man page as working (and on linux it does).
    Has anybody ever tried this on MacOS X in general and Leopard in particular?

    Dirk,
    I have run into the same issue, however I had ssh tunnels running between several macs before Dec 7 2008. But for some reason it broke on that day. Have been running remote rsync backups of the User data. Can give you the syntax if you want. But my point is it looks like this is a break in the OSX Unix system vs them just not being there as this was working prior to the 7th for several months.
    Am working with Apple to get this resolved but in the mean time where did you find the tun/tap drivers? I have some for Open VPN that I have been playing with on another machine but dunno if they will work or not.

  • Ssh tunnel how to set up in SL?

    I have a server running SL with the firewall activated.  I want to tunnel in to it from outside my own network, while on the road.  I have used SSH Tunnel Manager to do so in the past (like for 4 years) but can not get it to work today.
    On my SL Server 10.6.8 I can not find anywhere to open ports, but I understand that if I activate File Sharing and Remote Management it will open port 22.  Correct? 
    On my router I opened port 3283 and 5900.  Correct?
    Where I get stuck is what to put in to SSH Tunnel Manager.  I can not find any clear novice instructions for it anywhere.  And I am confused as to what to put where.
    Can anybody help?  Thanks.

    Thanks Bob, it is raining cats and dogs so good time to check.
    I got it all up and running. 
    I am testing from a real slow connection (on purpose as this what I have often being on the road) and the screen update is (too) slow.  I tried all your methods and can not see any different in speed (read slowness).
    BobHarris wrote:
    The reason I do this is because Chicken allows me to use reduced colors (like 8-bit colors), and the Vine Server both honors my reduced color request and it actually plays nice with reduced colors (the Mac OS X Screen Sharing server does not alway play nice with anything less then 32-bit colors, which needs a lot more bandwidth).
    Where or how do you implement this?  I can not find it anywhere.  I am on 10.6.8 btw.
    And what is more my connection over Mac's Screen Sharing client, having Vine Server server turned on or not on the remote Mac makes also no difference.  I can get in either way and speed is the same.
    Here is the setting of my remote Mac just in case I should not turn both, the last two, on:
    Than there is an other problem.
    I suppose this is not a problem as I am tunnelling in over SSH, but would like to make sure.
    I also tried to follow the instructions on the alert screen, but no such settings are to be found on the remote computer.  Must be an out of date message text.  Or am I blind?
    Looking forward to your wisdom.
    Message was edited by: ChangeAgent. 
    Had an external link for the images as they refused to upload.  Sometimes, when this happens, you can upload images after you post.  That worked so removed links.

  • How to set up Split Tunneling on ASA 5505

    Good Morning,
    I have an ASA 5505 with security plus licensing.  I need to set up split tunneling on the ASA and not sure how.  I am very new to Cisco but am learning quickly.   What I want to accomplish, if possible is to send all traffic to our corporate web site (static ip address) straight out to the internet and all other traffic to go though the tunnel as normal.  Basically we have a remote office that is using a local ISP to provide internet service.  IF our connection at the main office goes down, we want the branch office to still be able to get to our corporate website without having to unplug cables and connect their computer directly to the local ISP modem.   Any help with be greatly appriciated.   Thanks in advance.  Below is a copy of our current config.
    ASA Version 7.2(4)
    hostname TESTvpn
    enable password rBtWtkaB8W1R3ub8 encrypted
    passwd rBtWtkaB8W1R3ub8 encrypted
    names
    name 10.0.0.0 Corp_LAN
    name 192.168.64.0 Corp_Voice
    name 172.31.155.0 TESTvpn
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Vlan3
    nameif Corp_Voice
    security-level 100
    ip address 172.30.155.1 255.255.255.0
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    switchport access vlan 3
    ftp mode passive
    object-group network SunVoyager
    network-object host 64.70.8.160
    network-object host 64.70.8.242
    object-group network Corp_Networks
    network-object Corp_LAN 255.0.0.0
    network-object Corp_Voice 255.255.255.0
    access-list outside_access_in extended permit icmp any any unreachable
    access-list outside_access_in extended permit icmp any any echo-reply
    access-list outside_access_in extended permit icmp any any time-exceeded
    access-list inside_access_in extended permit ip TESTvpn 255.255.255.0 any
    access-list inside_access_in extended permit icmp TESTvpn 255.255.255.0 any
    access-list Corp_Voice_access_in extended permit ip 172.30.155.0 255.255.255.0 any
    access-list Corp_Voice_access_in extended permit icmp 172.30.155.0 255.255.255.0 any
    access-list VPN extended deny ip TESTvpn 255.255.255.0 object-group SunVoyager
    access-list VPN extended permit ip TESTvpn 255.255.255.0 any
    access-list VPN extended permit ip 172.30.155.0 255.255.255.0 any
    access-list data-vpn extended permit ip TESTvpn 255.255.255.0 any
    access-list voice-vpn extended permit ip 172.30.155.0 255.255.255.0 any
    access-list all-vpn extended permit ip TESTvpn 255.255.255.0 any
    access-list all-vpn extended permit ip 172.30.155.0 255.255.255.0 any
    pager lines 24
    logging enable
    logging buffer-size 10000
    logging monitor debugging
    logging buffered informational
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    mtu Corp_Voice 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-524.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list data-vpn
    nat (inside) 1 TESTvpn 255.255.255.0
    nat (inside) 1 0.0.0.0 0.0.0.0
    nat (Corp_Voice) 0 access-list voice-vpn
    access-group inside_access_in in interface inside
    access-group outside_access_in in interface outside
    access-group Corp_Voice_access_in in interface Corp_Voice
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    http TESTvpn 255.255.255.0 inside
    http Corp_LAN 255.0.0.0 inside
    http 65.170.136.64 255.255.255.224 outside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set VPN esp-3des esp-md5-hmac
    crypto map outside_map 1 match address VPN
    crypto map outside_map 1 set peer 66.170.136.65
    crypto map outside_map 1 set transform-set VPN
    crypto map outside_map interface outside
    crypto isakmp identity address
    crypto isakmp enable outside
    crypto isakmp policy 1
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 28800
    telnet timeout 5
    ssh Corp_LAN 255.0.0.0 inside
    ssh TESTvpn 255.255.255.0 inside
    ssh 65.170.136.64 255.255.255.224 outside
    ssh timeout 20
    console timeout 0
    management-access inside
    dhcpd auto_config outside
    dhcpd option 150 ip 192.168.64.4 192.168.64.3
    dhcpd address 192.168.1.2-192.168.1.33 inside
    dhcpd dns 10.10.10.7 10.10.10.44 interface inside
    dhcpd domain sun.ins interface inside
    dhcpd enable inside
    dhcpd address 172.30.155.10-172.30.155.30 Corp_Voice
    dhcpd dns 10.10.10.7 10.10.10.44 interface Corp_Voice
    dhcpd domain sun.ins interface Corp_Voice
    dhcpd enable Corp_Voice
    username admin password kM12Q.ZBqkvh2p03 encrypted privilege 15
    tunnel-group 66.170.136.65 type ipsec-l2l
    tunnel-group 66.170.136.65 ipsec-attributes
    pre-shared-key *
    prompt hostname context
    Cryptochecksum:953e50e9cbc02e1b264830dab4a3f2bd
    : end

    So I tried to use the exclude way that you suggested.   Here is my new config.   It is still not working.  The address I put in for the excluded list was 4.2.2.2  and when I do a trace route to it from the computer, it still goes though the vpn to the main office and out the switch at the main office and not from the local isp.   Any other suggestions?
    hostname TESTvpn
    domain-name default.domain.invalid
    enable password rBtWtkaB8W1R3ub8 encrypted
    passwd rBtWtkaB8W1R3ub8 encrypted
    names
    name 10.0.0.0 Corp_LAN
    name 192.168.64.0 Corp_Voice
    name 172.31.155.0 TESTvpn
    interface Vlan1
    nameif inside
    security-level 100
    ip address 172.31.155.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Vlan3
    nameif Corp_Voice
    security-level 100
    ip address 172.30.155.1 255.255.255.0
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    switchport access vlan 3
    ftp mode passive
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    object-group network SunVoyager
    network-object host 64.70.8.160
    network-object host 64.70.8.242
    object-group network Corp_Networks
    network-object Corp_LAN 255.0.0.0
    network-object Corp_Voice 255.255.255.0
    access-list outside_access_in extended permit icmp any any unreachable
    access-list outside_access_in extended permit icmp any any echo-reply
    access-list outside_access_in extended permit icmp any any time-exceeded
    access-list inside_access_in extended permit ip TESTvpn 255.255.255.0 any
    access-list inside_access_in extended permit icmp TESTvpn 255.255.255.0 any
    access-list Corp_Voice_access_in extended permit ip 172.30.155.0 255.255.255.0 a
    ny
    access-list Corp_Voice_access_in extended permit icmp 172.30.155.0 255.255.255.0
    any
    access-list VPN extended deny ip TESTvpn 255.255.255.0 object-group SunVoyager
    access-list VPN extended permit ip TESTvpn 255.255.255.0 any
    access-list VPN extended permit ip 172.30.155.0 255.255.255.0 any
    access-list data-vpn extended permit ip TESTvpn 255.255.255.0 any
    access-list voice-vpn extended permit ip 172.30.155.0 255.255.255.0 any
    access-list all-vpn extended permit ip TESTvpn 255.255.255.0 any
    access-list all-vpn extended permit ip 172.30.155.0 255.255.255.0 any
    access-list TEST standard permit host 4.2.2.2
    pager lines 24
    logging enable
    logging buffer-size 10000
    logging monitor debugging
    logging buffered informational
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    mtu Corp_Voice 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-524.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list data-vpn
    nat (inside) 1 TESTvpn 255.255.255.0
    nat (Corp_Voice) 0 access-list voice-vpn
    access-group inside_access_in in interface inside
    access-group outside_access_in in interface outside
    access-group Corp_Voice_access_in in interface Corp_Voice
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    http server enable
    http TESTvpn 255.255.255.0 inside
    http Corp_LAN 255.0.0.0 inside
    http 65.170.136.64 255.255.255.224 outside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set VPN esp-3des esp-md5-hmac
    crypto map outside_map 1 match address VPN
    crypto map outside_map 1 set peer 66.170.136.65
    crypto map outside_map 1 set transform-set VPN
    crypto map outside_map interface outside
    crypto isakmp identity address
    crypto isakmp enable outside
    crypto isakmp policy 1
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 28800
    crypto isakmp policy 65535
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh Corp_LAN 255.0.0.0 inside
    ssh TESTvpn 255.255.255.0 inside
    ssh 65.170.136.64 255.255.255.224 outside
    ssh timeout 20
    console timeout 0
    management-access inside
    dhcpd auto_config outside
    dhcpd option 150 ip 192.168.64.4 192.168.64.3
    dhcpd address 172.31.155.10-172.31.155.30 inside
    dhcpd dns 10.10.10.7 10.10.10.44 interface inside
    dhcpd domain sun.ins interface inside
    dhcpd enable inside
    dhcpd address 172.30.155.10-172.30.155.30 Corp_Voice
    dhcpd dns 10.10.10.7 10.10.10.44 interface Corp_Voice
    dhcpd domain sun.ins interface Corp_Voice
    dhcpd enable Corp_Voice
    group-policy DfltGrpPolicy attributes
    banner none
    wins-server none
    dns-server none
    dhcp-network-scope none
    vpn-access-hours none
    vpn-simultaneous-logins 3
    vpn-idle-timeout 30
    vpn-session-timeout none
    vpn-filter none
    vpn-tunnel-protocol IPSec l2tp-ipsec webvpn
    password-storage disable
    ip-comp disable
    re-xauth disable
    group-lock none
    pfs disable
    ipsec-udp disable
    ipsec-udp-port 10000
    split-tunnel-policy excludespecified
    split-tunnel-network-list value TEST
    default-domain none
    split-dns none
    intercept-dhcp 255.255.255.255 disable
    secure-unit-authentication disable
    user-authentication disable
    user-authentication-idle-timeout 30
    ip-phone-bypass disable
    leap-bypass disable
    nem disable
    backup-servers keep-client-config
    msie-proxy server none
    msie-proxy method no-modify
    msie-proxy except-list none
    msie-proxy local-bypass disable
    nac disable
    nac-sq-period 300
    nac-reval-period 36000
    nac-default-acl none
    address-pools none
    smartcard-removal-disconnect enable
    client-firewall none
    client-access-rule none
    webvpn
      functions url-entry
      html-content-filter none
      homepage none
      keep-alive-ignore 4
      http-comp gzip
      filter none
      url-list none
      customization value DfltCustomization
      port-forward none
      port-forward-name value Application Access
      sso-server none
      deny-message value Login was successful, but because certain criteria have not
    been met or due to some specific group policy, you do not have permission to us
    e any of the VPN features. Contact your IT administrator for more information
      svc none
      svc keep-installer installed
      svc keepalive none
      svc rekey time none
      svc rekey method none
      svc dpd-interval client none
      svc dpd-interval gateway none
      svc compression deflate
    username admin password kM12Q.ZBqkvh2p03 encrypted privilege 15
    tunnel-group 66.170.136.65 type ipsec-l2l
    tunnel-group 66.170.136.65 ipsec-attributes
    pre-shared-key *
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip
      inspect xdmcp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:8b3caaecf2a0dec7334633888081c367
    : end

  • Possible to ssh tunnel Bonjour traffic across different subnets?

    Hello:
    For quite some time, I have been thinking of buying a couple of iSights to enable audio/visual between two distant computers. But I really don't want to have to leave a dozen ports in my DSL modems opened up in order to use AIM or Jabber servers to iChatAV to my "usual" called parties (I can't help it, I'm paranoid - I have one ssh port open on my DSL modem at home - so most everything I do from afar -- afp (port 548), vnc( port 5900), etc., I tunnel it all over ssh).
    So, in a similar vein, what I would like to do is treat a distant computer as if it were on my local 192.168.x.x NAT subnet, in order to do a Bonjour-like iChatAV connection without having to go to through these public servers and without having to leave a dozen ports open in my firewall (or go through the drill of opening/closing ports every time I want to iChat).
    Now, if I understand this correctly, on one's local subnet, iChat AV works using Bonjour to communicate with other iChat AV users on the same subnet, which, I think, uses multicast packets. So I'm wondering if it is possible to ssh tunnel multicast traffic to a different computer like so:
    ssh -L 5297:localhost:5297 -L 5298:localhost:5298 {called.party.IP.address}
    thus being able to set up a secure point-to-point iChatAV connection?
    Anybody ever do something like this?

    Hin j.v.,
    It is possible to iChat Bonjour over a Virtual Private Network , yes.
    2:33 PM Thursday; May 4, 2006

  • SSH tunneling to connect to remote computer

    Hi,
    I have to connect to my remote database(RHEL box) from a windows using SSH tunnel
    1. I have set up the SSH tunneling(with outgoing tunnel)
    2. I have made a entry in the TNSnames.ora file
    3. I establish connection to the remote server using SSH client and when i do tnsping
    i do get connection. Even when i change the host name to some unkown name i do get a tnsping but iam not able to connect to the database. do iam wrong anywhere
    Used TNSNAMES adapter to resolve the alias
    Attempting to contact (DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST = ISIL-PRJ
    -04)(PORT = 1523)) (CONNECT_DATA = (SID = ora1022b)))
    OK (800 msec)
    Used TNSNAMES adapter to resolve the alias
    Attempting to contact (DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST = ISIL-PRJ
    -04)(PORT = 1523)) (CONNECT_DATA = (SID = blablabla)))
    OK (800 msec)
    even when i change my sid name i get a tnsping. can anybody explain

    Hi,
    Looking for this schema below and see if help you:
               Secure Connection
       +---->-------[SSH]-------->-----+
       |                               |
       |                               |
       ^                               |
       |       Insecure Connection     v
    CLIENT---->--------------------> ORACLE
    ssh2 -l oracle -L 1521:192.148.1.251:1521 200.10.11.12
                        |          |                |
                        |          |                |
                   A  LOCAL        |                |
                   B       INTERNAL IP ORACLE       |
                   C                       EXTERNAL IP (GATEWAY)
                                                         C                             B
          | Firewall| . . . . .|INTERNET| . . . . . . |Firewall| . . . . . . . . . . |ORACLE|
          | Gateway |                                 |Gateway |                 192.148.1.251:1521
               .                                     200.10.11.12                                  
         A     .
       |Oracle Client|
       (TNSNAMES.ORA)
         <SERVICE> =
           (DESCRIPTION =
             (ADDRESS_LIST =                     
               (ADDRESS = (PROTOCOL = TCP)(HOST = 127.0.0.1)(PORT = 1521))
             (CONNECT_DATA =
               (SID = <SID>)
           )Cheers

  • Jconsole - remote connection thru ssh-tunnel

    Hi all,
    I need to start jconsole on my windows-box and connect to a remote tomcat-server thru an ssh-tunnel.
    I have walked thru various posts and blogs, but finally couldn't get it running.
    On the linux-server, I have set the following JAVA_OPTS:
    export JAVA_OPTS='-Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.port=8888 -Dcom.sun.management.jmxremote.ssl=false -Djava.rmi.server.useLocalHostname=true -Dcom.sun.management.jmxremote.authenticate=false -Djava.rmi.server.hostname=myserver'myserver is the server-name that is resolved by the hostname-command. I also tried using localhost instead.
    On the client I run the following ssh-command to create the tunnel:
    ssh tomcat@myserver -L8888:myserver:8888 -N -vWhen I try to create a remote connection with jconsole using localhost:8888, I see the following output by ssh:
    debug1: Connection to port 8888 forwarding to myserver port 8888 requested.
    debug1: channel 1: new [direct-tcpip]
    debug1: channel 1: free: direct-tcpip: listening port 8888 for myserver port 8888, connect from 127.0.0.1 port 1618, nchannels 2It looks not too bad to me, but unfortunately, jconsole runs into a timeout after about 2 mins.
    On the server I see the following using netstat:
    tcp        0    168 myserver:ssh    mywindowsbox:3381  VERBUNDEN  
    tcp        0      0 myserver:ssh    mywindowsbox:1317  VERBUNDEN  
    tcp        0      0 myserver:44625  myserver:8888   TIME_WAIT  
    tcp        0      0 *:8888                      *:*                         LISTENIt appears to me that the tomcat-server is listening correctly on port 8888 for all incoming hosts (although localhost should be enough).
    Furthermore, it seems that the ssh-tunnel has been establised.
    Why the hell, jconsole still can't connect?

    Hiya.
    JMX connections use two ports. You need the RMI Registry and the RMI Stub. This first one you bound to port 8888, but the other one is probably still bound to a random port. You need to be able to access that one through SSH as well.
    Trouble is that the second port uses a random port and most application servers can't statically configure this one. See this article for possible solutions (be sure to read the follow ups as well) : http://blogs.sun.com/jmxetc/entry/connecting_through_firewall_using_jmx
    Cheers,
    Hugp

  • Remote printing problem using ssh tunnel in Leopard

    Haho,
    I've recently installed Leopard, and I have unexpected difficulties with setting up remote printing to the printers of my University via ssh tunneling. The following procedure worked (and still works) under Tiger, but for some reason it doesn't work with Leopard (not just for me, but other friends also have the same issue as I do). The question is what could be the source of the problem and how could I get around it?
    So, I have the same short user name on my home Mac as my login name in the University system. Then, I set up the proper printers (IP printer, LPD protocol, Address: localhost, the appropriate queue and printer type etc.). Whenever I want to print from home to the University, I would open a Terminal window, and sudo ssh -L515:XXX.XXX.XXX.XXX:515 [email protected] . This is supposed to channel the printing which is sent to a localhost printer to the printers which can be reached through the University IP address.
    This method worked and works well under the latest version of Tiger, but not under Leopard (10.5, 9A581). I get no error messages, the printing seems to go through (at least no error seems to occur during spooling or logging in to the University with the terminal), but it simply doesn't prints out on the other end.
    I have no firewall or any other new network tools running which I'm aware of, and I'm not aware of any differences in the set-ups besides the change in the OS. The issue might be that of compatibility with the University printing system, but help in what exactly changed on the Mac side (something obviously did change) would help me a lot, especially since I don't think that the University technical crew would be very keen on (or competent in, for that matter) troubleshooting.
    Thanks in advance for your help!

    Had the same issue with MS Terminal Server printing over vpn tunnel.
    what kind of internet connection do you have? one which adds extra headers like pppoe ?
    for me ...
    sysopt connection tcpmss
    helped
    default is 1380 (1380 data + 20 TCP + 20 IP + 24 AH + 24 ESP_CIPHER + 12 ESP_AUTH + 20 IP = 1500 bytes)

  • Using Workgroup Manager via SSH tunnel

    Hi all,
    I'm attempting to use the Workgroup Manager app to remotely administer a OS X Tiger Server box. The server sits inside my company's LAN behind a firewall, which only allows traffic to the server on ports 21 (ftp), 22 (ssh), 80 (http) and 311 (server admin with SSL, I believe). All services on those ports work fine.
    My research on the net indicates that the Workgroup Manager app uses port 625, but since the hardware firewall is blocking traffic on that port to the server, I'd like to create an SSH tunnel to access it. I've tried the following command on my local machine (i.e., not the server):
    $ sudo ssh -L 625:localhost:625 [email protected]
    and am able to set up the tunnel with no problem. However when I try to connect Workgroup Manager (on the local machine) to localhost, it won't let me connect. So I tried telnetting to localhost port 625 (on the local machine) to see what's up, and received the following error:
    $ telnet localhost 625
    Trying ::1...
    Connected to localhost.
    Escape character is '^]'.
    Connection closed by foreign host.
    Am I missing something? I was under the impression that the SSH tunnel would allow me to access port 625 on the server via port 22. The software firewall is disabled on both machines, so it's not that. I'm not experienced with SSH tunnelling, so I could be totally wrong about the way this is supposed to work.
    Thanks in advance!

    A quick tcpdump here indicates that Workgroup Manager uses both 311 and 625 when establishing a connection to the server. It may be the lack of port 311 tunneling that's causing your problem.
    $ sudo ssh -L 625:localhost:625 -L 311:localhost:311 [email protected]

  • SSH Tunnel to an Oracle SQL Server

    Hi all,
    I am attempting to set up an ssh tunnel from my local machine to an Oracle SQL server operating on a remote computer, and use it to run a perl script to extract things from that database.
    My question is, do I need to have an SQL client on the local machine for this to work? The remote computer does not have the Oracle DBD installed, while the local machine does (hence running the script on the local computer), but will the DBD hand of requests correctly through the ssh tunnel to the SQL server on the remote machine without a client on the local one?
    Thanks!

    The data access is all happening on the Oracle machine right? Then no, all your local machine needs is an ssh client - that's it. After that all processing is running on the server.

  • Crashes when using SSH tunnel

    Anyone have a workaround for Safari crashing when tunneling over ssh. I'm using an SSH tunnel when working at coffee shops and Safari keeps on crashing. I'm doing a:
    ssh [email protected] -D 8080
    to set up my tunnel. Is there a fix, perhaps using another port?
    Cheers
    Richard

    Leopard fixes the problem! Horrrahhh!

  • Screen Sharing.app fails through ssh tunnel with "You cannot control your own screen"

    I need to control a remote Mac mini running 10.7 through an ssh tunnel.  I've set up ssh with -L for the appropriate ports, and bound my local ports 5900 and 5800 through this.
    When I connect to 127.0.0.1 with Screen Sharing.app on my macbook pro which runs 10.8.4, it says "You cannot control your own screen" however, screen sharing is not enabled locally on my machine, I'm trying to access a remote machine.
    I tried something else.  I created an alias IP of 127.0.0.2 on lo0, and tried again, and got the same thing, so it's doing an ifconfig and looking through all the IPs to see if the IP address of what I'm trying to connect to is bound locally, which defeats the purpose of tunneling through SSH.  I don't wish to setup a VPN.
    How do I let the Screen Sharing.app know that I'm not trying to connect to my own machine and it should skip this check.
    I've also tried with another app, Chicken of the VNC, and that almost works.  It connects and shows a login screen desktop to the target machine, but I'm unable to click on any of the account icons displayed in order to login, and all key presses such as tab, space, and enter are ignored.
    When at the location (on the same vlan as the target machine) I'm able to remote into it just fine with screen sharing.app, but Chicken of the VNC has the same issue of showing a login screen, but not allowing logins to it.

    Your ssh command should look something like:
    ssh -L 22590:localhost:5900 remove.mac.system.address
    Then you connect using
    Finder -> Go -> Connect to server -> vnc://localhost:22590
    Have you been doing anything close to that?

  • SMB through SSH tunnel

    I'm having trouble setting up samba access over an SSH tunnel. If I forward port 139 on my machine to port 139 on the server, like so,
    ssh -L 139:localhost:139 user@server
    and then connect from the finder with Go -> Connect to Server and enter "smb://localhost/username" it works great. Moreover, if I do "smbclient -L localhost -U username" I get (with names changed to protect the innocent):
    Domain=[MYSERVERNAME] OS=[Unix] Server=[Samba 3.0.24]
    Sharename Type Comment
    IPC$ IPC IPC Service (Myservername)
    username Disk Home Directories
    Domain=[MYSERVERNAME] OS=[Unix] Server=[Samba 3.0.24]
    Server Comment
    Workgroup Master
    OATESNET MYSERVERNAME
    That's great. However, I need to in fact be running a samba server on my local machine as well as accessing a remote one --- therefore, I can't forward from port 139 on my local machine because it conflicts with my local samba server (actually, I can, and it appears to be a crapshoot whether my local server or the remote server through SSH gets the connection. Weird. But that's a different story).
    So, I try and forward from a different port, say 52187. So I create my tunnel:
    ssh -L 52187:localhost:139 username@server
    Now I try and connect through the Finder. I get error:
    "The Finder cannot complete the operation because some data in "smb://localhost:52187/username" could not be read or written. (Error code -36)."
    Hmm. Let's try and diagnose from the console. I type:
    smbclient -L localhost -U username -p 52187
    It connects to the remote server, but only partially. I get the following output:
    Domain=[MYSERVERNAME] OS=[Unix] Server=[Samba 3.0.24]
    Sharename Type Comment
    IPC$ IPC IPC Service (Myservername)
    username Disk Home Directories
    Error connecting to 127.0.0.1 (Invalid argument)
    Connection to localhost failed
    NetBIOS over TCP disabled -- no workgroup available
    Weird. Note that this is with my local Samba server not running. Now, if I try and run smbclient with the local server running, I get a different error:
    Domain=[MYSERVERNAME] OS=[Unix] Server=[Samba 3.0.24]
    Sharename Type Comment
    IPC$ IPC IPC Service (Myservername)
    username Disk Home Directories
    session setup failed: NTSTATUS_LOGONFAILURE
    NetBIOS over TCP disabled -- no workgroup available
    Weirder --- so I look in the log files for the local Samba server (/var/log/samba/log.smbd). There are two new messages from the exact time when I tried to contact my remote server:
    [2007/06/20 17:35:08, 0] /SourceCache/samba/samba-100.7/samba/source/smbd/server.c:main(789)
    smbd version 3.0.10 started.
    Copyright Andrew Tridgell and the Samba Team 1992-2004
    [2007/06/20 17:35:08, 0] pdbods.c:odssamgetsampwnam(2329)
    odssam_getsampwnam: [0]getsam_recordattributes dsRecTypeStandard:Users no account for 'username'!
    Note that 'username' is not a user on my local machine. I'm not sure what would happen if it were.
    What looks like is happening to me is that the samba client is in fact contacting the server on the port that I give, but then trying to initiate some other communication (authentication?) on the default port, 139. That's why when I'm forwarding from port 139 it all works fine. That's also why I get a different error message and stuff in my local logs when the local server is running --- the samba client is contacting the remote server for part of the transaction and the local server for another part. When the local server isn't running, it just can't contact anyone and gets confused.
    The question is, how can I make the samba client consistently use the port I tell it to use? Am I missing something?
    -Andrew
    PS -- why is it that I can have both a local samba server running on port 139 and an SSH tunnel that forwards from that port at the same time? Does it have to do with what interfaces their bound on? As in, the SSH server is only bound on the loopback interface, while the Samba server is only bound on my ethernet card? That's the only explanation I could think of.

    well, I'm not doing a smb mount and have never tried to do an smb mount; only an afp mount. I'm very fortunate that I have Macs at work and home, and all authorized users to my computer are Mac users.
    I'm running OS 10.4.9 and have been doing this (afp over ssh) throughout all iterations of 10.4.x and most if not all iterations of 10.2.x up through 10.2.8 on two older computers, a 2001 Quicksilver and a 2002 Quicksilver as the servers, and using them as the clients as well along with two Powerbook G4s as clients. Also, my kids (if you call ages 20-26 "kids") afp mount via ssh tunneling as well, from an iBookG4 and iMac G5s, also running 10.4.9.
    I gotta ask a dumb question or two or three or four:
    • When you ssh, obviously you have the ssh port (only) forwarded through your router and/or modem at home, right?
    • Do you have your Mac's (the one you are trying to use as the server) firewall turned on or off? And if on, what ports/services do you have turned on in Sys Prefs Sharing? (and if off, what services are turned on?) Windows Sharing is on?
    • If you turned on personal file sharing in your "server" Mac, do you have another Mac that you could try to ssh into, tunneling port XXXX:localhost:548 then from Finder, ⌘k to localhost:XXXX, just to see if that at least works?
    • highly unlikely to make a difference, but when you ⌘k to smb://localhost:XXXX, does it help to leave off the "/username" that you had reported in preious posts as appending onto the servername?
    One last-minute comment/suggestion: There is a shareware/donationware program called sharepoints that looks pretty cool; you can check that your mount points on your server are indeed smb shared or not (as a side note, if you are so inclined, you can create additional mount points other than just users' home directories, too). I am totally clueless as to how one, from the unix command line or maybe from the NetInfo manager, might do this, so if you would be treading new ground here yourself in this regard, this program might be of some value to you.

  • SSH tunneling X to locked Windows computer.

    Hi
    I have recenty installed and configurated ssh to tunnel x. But I need a way to connect to it on a school computer and every other type of computer where I cant install softwares. The windows computers in school are all part of some sort of thin clients /server solution. And I cant post stuff on the desctop I can't reach the harddrives or any thing like that. I got a network share where I might be able to put stuff. Also I can't use a usb stick and start to software from there. So is there a possible way to ssh tunnel x to one of these computers?
    Last edited by lintz (2010-03-03 07:52:23)

    Use Putty on the windows machine. It's a simple .exe which doesn't need to be installed anywhere.
    http://www.chiark.greenend.org.uk/~sgtatham/putty/
    There are plenty of 'how to' guides for using Putty to access an ssh server and setting up and using tunnels.
    http://souptonuts.sourceforge.net/sshtips.htm
    http://jstrassburg.blogspot.com/2006/01 … th-dd.html
    etc. etc.
    It'll do what you want. I use the same to get from XP at work to home, and we have similar restrictions at work. Even better - by using x11vnc on Arch and then vncviewer on XP (also a simple .exe) I am able to bring up my Arch desktop as a remote desktop on my XP setup.
    The one thing I haven't worked out yet is how to copy files from my Arch machine to XP at work, since I am unable to setup an ssh server at work - although I can now email them to myself using the remote desktop!
    Last edited by sultanoswing (2010-03-03 08:49:30)

  • Using portal admin console through an ssh tunnel?

    I'm trying to login on the portal admin over an established ssh connection:
    - profile server listen on hostname.subdomain.domain, port 8080
    - an ssh tunnel (via portforwarding through a firewall) from client port
    10000 to profile server 8080
    - connect from webbrowser to http://localhost:10000/console
    that won't work: internal server errors. If i change my hosts file:
    localhost 127.0.0.1 hostname.subdomain.domain
    it works. But this is ugly and conflicts with DNS.
    So, how can i configure the profile server to accept connections over an ssh
    tunnel? Anyone any idea?
    regards, Jordi

    Hello,
    Does any one in BEA have an answer to this. I was stumped when asked by a client. Any response will be great.
    C

Maybe you are looking for

  • My Macbook pro 17" stopped working

    my Macbook pro 17" stopped working I was surprised that Apple told me they no longer have support the 17" Macbook pro

  • Define screen layout at document level

    Hi all, It's possible to define a screen layout at document level for custom fields of PO? In others word, in customing i can define the status of PO (headers and items) fields, can I do the same for custom fields? thanks in advantage, enzo PS. I'm u

  • Using Handbrake to burn DVD movie to iTunes to sync to iTouch

    What steps do you take to burn a DVD movie to iMac iTunes so you can sync it when iTouch is hooked to it?

  • GridPane misbehaving?

    ..or am I doing something wrong? The gridPane 'container' is itself a child of a scroll pane. The first three 'rows' of the grid overlap, and the column height constraints are ignored when I increase the vertical height of the window (the grow/shrink

  • Spry Effects don't work in IE

    Greetings: Is there a way to use multiple fade effects in IE for the menu widget? Currently, what's happening is that when I add the fade effect to the parent div to the menu, the child node does not want to expand to its third child in IE. However,