SMB through SSH tunnel

Question

I'm having trouble setting up samba access over an SSH tunnel. If I forward port 139 on my machine to port 139 on the server, like so,
ssh -L 139:localhost:139 user@server
and then connect from the finder with Go -> Connect to Server and enter "smb://localhost/username" it works great. Moreover, if I do "smbclient -L localhost -U username" I get (with names changed to protect the innocent):
Domain=[MYSERVERNAME] OS=[Unix] Server=[Samba 3.0.24]
Sharename Type Comment
IPC$ IPC IPC Service (Myservername)
username Disk Home Directories
Domain=[MYSERVERNAME] OS=[Unix] Server=[Samba 3.0.24]
Server Comment
Workgroup Master
OATESNET MYSERVERNAME
That's great. However, I need to in fact be running a samba server on my local machine as well as accessing a remote one --- therefore, I can't forward from port 139 on my local machine because it conflicts with my local samba server (actually, I can, and it appears to be a crapshoot whether my local server or the remote server through SSH gets the connection. Weird. But that's a different story).
So, I try and forward from a different port, say 52187. So I create my tunnel:
ssh -L 52187:localhost:139 username@server
Now I try and connect through the Finder. I get error:
"The Finder cannot complete the operation because some data in "smb://localhost:52187/username" could not be read or written. (Error code -36)."
Hmm. Let's try and diagnose from the console. I type:
smbclient -L localhost -U username -p 52187
It connects to the remote server, but only partially. I get the following output:
Domain=[MYSERVERNAME] OS=[Unix] Server=[Samba 3.0.24]
Sharename Type Comment
IPC$ IPC IPC Service (Myservername)
username Disk Home Directories
Error connecting to 127.0.0.1 (Invalid argument)
Connection to localhost failed
NetBIOS over TCP disabled -- no workgroup available
Weird. Note that this is with my local Samba server not running. Now, if I try and run smbclient with the local server running, I get a different error:
Domain=[MYSERVERNAME] OS=[Unix] Server=[Samba 3.0.24]
Sharename Type Comment
IPC$ IPC IPC Service (Myservername)
username Disk Home Directories
session setup failed: NTSTATUS_LOGONFAILURE
NetBIOS over TCP disabled -- no workgroup available
Weirder --- so I look in the log files for the local Samba server (/var/log/samba/log.smbd). There are two new messages from the exact time when I tried to contact my remote server:
[2007/06/20 17:35:08, 0] /SourceCache/samba/samba-100.7/samba/source/smbd/server.c:main(789)
smbd version 3.0.10 started.
Copyright Andrew Tridgell and the Samba Team 1992-2004
[2007/06/20 17:35:08, 0] pdbods.c:odssamgetsampwnam(2329)
odssam_getsampwnam: [0]getsam_recordattributes dsRecTypeStandard:Users no account for 'username'!
Note that 'username' is not a user on my local machine. I'm not sure what would happen if it were.
What looks like is happening to me is that the samba client is in fact contacting the server on the port that I give, but then trying to initiate some other communication (authentication?) on the default port, 139. That's why when I'm forwarding from port 139 it all works fine. That's also why I get a different error message and stuff in my local logs when the local server is running --- the samba client is contacting the remote server for part of the transaction and the local server for another part. When the local server isn't running, it just can't contact anyone and gets confused.
The question is, how can I make the samba client consistently use the port I tell it to use? Am I missing something?
-Andrew
PS -- why is it that I can have both a local samba server running on port 139 and an SSH tunnel that forwards from that port at the same time? Does it have to do with what interfaces their bound on? As in, the SSH server is only bound on the loopback interface, while the Samba server is only bound on my ethernet card? That's the only explanation I could think of.

Answer 1

well, I'm not doing a smb mount and have never tried to do an smb mount; only an afp mount. I'm very fortunate that I have Macs at work and home, and all authorized users to my computer are Mac users.
I'm running OS 10.4.9 and have been doing this (afp over ssh) throughout all iterations of 10.4.x and most if not all iterations of 10.2.x up through 10.2.8 on two older computers, a 2001 Quicksilver and a 2002 Quicksilver as the servers, and using them as the clients as well along with two Powerbook G4s as clients. Also, my kids (if you call ages 20-26 "kids") afp mount via ssh tunneling as well, from an iBookG4 and iMac G5s, also running 10.4.9.
I gotta ask a dumb question or two or three or four:
• When you ssh, obviously you have the ssh port (only) forwarded through your router and/or modem at home, right?
• Do you have your Mac's (the one you are trying to use as the server) firewall turned on or off? And if on, what ports/services do you have turned on in Sys Prefs Sharing? (and if off, what services are turned on?) Windows Sharing is on?
• If you turned on personal file sharing in your "server" Mac, do you have another Mac that you could try to ssh into, tunneling port XXXX:localhost:548 then from Finder, ⌘k to localhost:XXXX, just to see if that at least works?
• highly unlikely to make a difference, but when you ⌘k to smb://localhost:XXXX, does it help to leave off the "/username" that you had reported in preious posts as appending onto the servername?
One last-minute comment/suggestion: There is a shareware/donationware program called sharepoints that looks pretty cool; you can check that your mount points on your server are indeed smb shared or not (as a side note, if you are so inclined, you can create additional mount points other than just users' home directories, too). I am totally clueless as to how one, from the unix command line or maybe from the NetInfo manager, might do this, so if you would be treading new ground here yourself in this regard, this program might be of some value to you.