Samba/CIFS Shares Remotely

[russdyer]

Are there any tutorials for accessing a CIFS share over an SSH tunnel? I would like access to the shares from outside my network.

 

[ProtoSD]

Not yet, while I was away this fall I was trying to get this working. There are some technical issues. There are some instructions on the web, but they're either outdated or don't work. It's on my list of things to post in the HowTo area when I get more time to work on it.

What version of Windows are you using? I *think* it might be easier with XP, but since I'm trying to get it working with Windows 7 there are some problems. The other postings I mentioned were for Vista and XP.

EDIT: Here's a link to that guide, the problem is the part "Tweaking the SMB driver", there's netsh command that appears to work, until you get further down in the guide and discover that the command doesn't actually make the change.

CifsOverSSH/VistaLoopback.html

 

[russdyer]

Samba

If you could work on this as your next project with a guide, that would be great. I would love to get this working and I will try to find a solution as well. I am on Freenas 8 and connect using win 7.

 

[russdyer]

It looks like that guide that you posted the link for has been updated for Windows 7. I will try it out and inform you of the results.

 

[ProtoSD]

Yes, it has been, but it didn't work for me. Like I mentioned above, the 'netsh' command appears to work, but later when they ask you to test it, the settings are gone. I'd be curious to hear if you get it to work, or if it's something on my system. I hope you get it to work, then I'll have to dig deeper and figure out why I couldn't get it to work.

 

[russdyer]

i got through most of the guide and didn't have a problem with the netsh command. it seemed to work fine. where i seem to be lost at the the "Configuring PUTTY" section. Do I need to even use putty and does it need to be run each time? In the PUTTY configuration if wanted me to put in "login2.nikhef.nl" as the destination. Would I substitute this out for my IP address of my FreeNAS box? I opened up port 44445 --> 445 for port forwarding on my router. In the PUTTY Sessions section, the guide says to just save the config but do I need to fill in hostname/port?

You may want to have another go at this and see where you end up. Is the point of this guide to give me access to a Samba share when outside of my home network? Because that is what I am looking for.

 

[ProtoSD]

I'm glad to hear you're having better luck. Let me sort out your questions:

Do I need to even use putty and does it need to be run each time?

YES

In the PUTTY configuration if wanted me to put in "login2.nikhef.nl" as the destination. Would I substitute this out for my IP address of my FreeNAS box?

NO, this would be your external IP/hostname, the address your router gets assigned by your ISP.

In the PUTTY Sessions section, the guide says to just save the config but do I need to fill in hostname/port?

On the tunnel part for your Destination, you would put the IP for your FreeNAS like 192.168.1.100:445
This seems confusing but...

The scroll back up to the top to the "Session" part of the tree. Put your hostname or external IP, but the port '22', this depends.
Some internet providers block those ports, and if not, hackers look for them there. You could use your router to map say port 32222 to 22 on your local network, BUT I think stick to the directions for now and leave it 22 until you get it working and then make adjustments.

Make sure the 'Connection Type' selection is set to SSH.

Then in the text box "Saved Sessions" make a name for these settings and click on SAVE.

Is the point of this guide to give me access to a Samba share when outside of my home network?

You still need to do the rest of the instructions, but you're almost finished.

The part where it says to fill out your "Nikhef-Windows userid", this would just be whatever user you have setup to access your CIFS/Samba share, or maybe nothing if you have guest access setup on FreeNAS.

It's tough for me to test this because I need to have a network connection outside of my home to test it and I don't have that right now. I am really anxious to try it and hope you get it working. If you can get Putty to connect, you're like 99% there.

 

[russdyer]

Ok, thanks for clearing that up. So, I can connect through Putty using the Tunnel settings and I do get a Windows Firewall popup that asks if I want to allow an SSH connection, so that must be a good sign.

So, I log into PUTTY under root and all seems well. I check out the PUTTY log and get the following:

Code:

2011-10-18 23:03:26	Local port 10.255.255.1:44445 forwarding to 192.168.1.50:445
2011-10-18 23:03:26	Allocated pty (ospeed 38400bps, ispeed 38400bps)
2011-10-18 23:03:26	Started a shell/command

However, when I try to START-->RUN-->\\10.255.255.1 and check the PUTTY log again, I get:

Code:

2011-10-18 23:05:38	Opening forwarded connection to 192.168.1.50:445
2011-10-18 23:05:38	Forwarded connection refused by server: Administratively prohibited [open failed]
2011-10-18 23:05:38	Opening forwarded connection to 192.168.1.50:445
2011-10-18 23:05:38	Forwarded connection refused by server: Administratively prohibited [open failed]
2011-10-18 23:05:39	Opening forwarded connection to 192.168.1.50:445
2011-10-18 23:05:39	Forwarded connection refused by server: Administratively prohibited [open failed]
2011-10-18 23:05:39	Opening forwarded connection to 192.168.1.50:445
2011-10-18 23:05:40	Forwarded connection refused by server: Administratively prohibited [open failed]
2011-10-18 23:05:40	Opening forwarded connection to 192.168.1.50:445
2011-10-18 23:05:40	Forwarded connection refused by server: Administratively prohibited [open failed]
2011-10-18 23:05:41	Opening forwarded connection to 192.168.1.50:445
2011-10-18 23:05:41	Forwarded connection refused by server: Administratively prohibited [open failed]
2011-10-18 23:05:41	Opening forwarded connection to 192.168.1.50:445
2011-10-18 23:05:42	Forwarded connection refused by server: Administratively prohibited [open failed]
2011-10-18 23:05:43	Opening forwarded connection to 192.168.1.50:445
2011-10-18 23:05:44	Forwarded connection refused by server: Administratively prohibited [open failed]
2011-10-18 23:05:59	Opening forwarded connection to 192.168.1.50:445
2011-10-18 23:06:05	Forwarded connection refused by server: Administratively prohibited [open failed]
2011-10-18 23:06:05	Opening forwarded connection to 192.168.1.50:445
2011-10-18 23:06:05	Forwarded connection refused by server: Administratively prohibited [open failed]
2011-10-18 23:06:05	Opening forwarded connection to 192.168.1.50:445
2011-10-18 23:06:06	Forwarded connection refused by server: Administratively prohibited [open failed]
2011-10-18 23:06:06	Opening forwarded connection to 192.168.1.50:445
2011-10-18 23:06:06	Forwarded connection refused by server: Administratively prohibited [open failed]
2011-10-18 23:06:06	Opening forwarded connection to 192.168.1.50:445
2011-10-18 23:06:07	Forwarded connection refused by server: Administratively prohibited [open failed]
2011-10-18 23:06:07	Opening forwarded connection to 192.168.1.50:445
2011-10-18 23:06:08	Forwarded connection refused by server: Administratively prohibited [open failed]
2011-10-18 23:06:08	Opening forwarded connection to 192.168.1.50:445
2011-10-18 23:06:08	Forwarded connection refused by server: Administratively prohibited [open failed]
2011-10-18 23:06:09	Opening forwarded connection to 192.168.1.50:445
2011-10-18 23:06:10	Forwarded connection refused by server: Administratively prohibited [open failed]
2011-10-18 23:06:10	Opening forwarded connection to 192.168.1.50:445
2011-10-18 23:06:10	Forwarded connection refused by server: Administratively prohibited [open failed]
2011-10-18 23:06:10	Opening forwarded connection to 192.168.1.50:445
2011-10-18 23:06:11	Forwarded connection refused by server: Administratively prohibited [open failed]
2011-10-18 23:06:12	Opening forwarded connection to 192.168.1.50:445
2011-10-18 23:06:12	Forwarded connection refused by server: Administratively prohibited [open failed]
2011-10-18 23:06:12	Opening forwarded connection to 192.168.1.50:445
2011-10-18 23:06:12	Forwarded connection refused by server: Administratively prohibited [open failed]
2011-10-18 23:06:12	Opening forwarded connection to 192.168.1.50:445
2011-10-18 23:06:13	Forwarded connection refused by server: Administratively prohibited [open failed]
2011-10-18 23:06:13	Opening forwarded connection to 192.168.1.50:445
2011-10-18 23:06:13	Forwarded connection refused by server: Administratively prohibited [open failed]
2011-10-18 23:06:14	Opening forwarded connection to 192.168.1.50:445
2011-10-18 23:06:14	Forwarded connection refused by server: Administratively prohibited [open failed]
2011-10-18 23:06:14	Opening forwarded connection to 192.168.1.50:445
2011-10-18 23:06:14	Forwarded connection refused by server: Administratively prohibited [open failed]
2011-10-18 23:06:14	Opening forwarded connection to 192.168.1.50:445
2011-10-18 23:06:15	Forwarded connection refused by server: Administratively prohibited [open failed]

So, for some reason it keeps refusing the connection within PUTTY and then Windows says that the network share is not available.

Just thought I would update this with you. Now, I am only putting in \\10.255.255.1 where in the example in the instructions, he puts \\10.255.255.1\user\<Your-nikhef-userid>. I even tried \\10.255.255.1\user\root but that didn't work.

 

[ProtoSD]

Sorry if I wasn't clear about this part, but you need to change the 192.168.1.50, I'm not sure, but it will either be the IP of your PC or the IP of your FreeNAS server.

Sounds like you're very close, thanks for the update.

EDIT: I guess you did change it, I had .100 I need to look at this a little, I'll update in a bit.

 

[russdyer]

yeah, i did change that. my freenas internal address is .50

 

[ProtoSD]

Ok, I think you need to go back into putty, load that config, go back to the tunnels and change the 192.168.1.50 to the external IP address of your router and don't forget the :445. After you change that, go back to session and click SAVE again.

*Hopefully* that will work....

 

[russdyer]

it didn't. i feel like i am so freakin' close!

in the PUTTY SSH-->TUNNELS section, I have:

Code:

L10.255.255.1:44445 192.168.1.50:445

or

Code:

L10.255.255.1:44445 MY.EXT.IP:445

Under the Destination section, I have "local" and "auto" choosen. It doesn't seem to "work" any other way. By "work" I mean that checking the event log, it will refuse the SSH connection right away if I choose anything other than "local" or "auto". I am also leaving the two "Port Forwarding" options unchecked.

I also have port forwarding on my router set to allow port 445 to hit my FreeNAS box IP.

I will look into google.

 

[russdyer]

I wonder if I have found the problem. I am running DD-WRT on my router and noticed that under Services, "Secure Shell" was disabled. Here are my settings now under DD-WRT Services-->Secure Shell:

SSHd, SSH TCP Forwarding, Password Login = Enabled
Port = 22
Authorized Keys =?

So, do I need to enter Authorized Keys and how do I do this?

Is this why I am getting:

Code:

2011-10-19 10:37:06	Forwarded connection refused by server: Administratively prohibited [open failed]
2011-10-19 10:37:06	Opening forwarded connection to 192.168.1.50:445

 

[ProtoSD]

I wonder if I have found the problem. I am running DD-WRT on my router and noticed that under Services, "Secure Shell" was disabled. Here are my settings now under DD-WRT Services-->Secure Shell:

It's great that you have DD-WRT on your router, I do also. That should be a plus. I had mine setup to do tunnels for other stuff this summer and it worked great. I *think* in the Unofficial FAQ in my sig below, I have a link for setting it up for tunnels, but you don't need a key. I'd leave that alone for now, it adds an extra variable that you don't need right now.

I haven't had my coffee yet, so I'll need to look at this later. I don't have any ideas off the top of my head right now.

Under the Destination section, I have "local" and "auto" choosen. It doesn't seem to "work" any other way.

I think that's the way it's supposed to be. If you look at the instructions there's screenshot with those selected.


EDIT: That link isn't in the FAQ, I'll see if I can find it.

 

[ProtoSD]

I opened up port 44445 --> 445 for port forwarding on my router.

Have you tried opening port 445 on your router?

Actually, I just had a thought (its still early for me), what is doing the receiving/decrypting of the tunnel after your router, on your LAN?
The tunnel needs an endpoint to decode and then forward on the local network. You can use your router to do that, but I'll bet it's not setup for it. I think what's happening now is your router is just forwarding the tunnel to your FreeNAS box and FreeNAS doesn't know what to do. I need to find the Tunnel setup guide for DD-WRT..... brb...

Here's the link for setting up tunnels on DD-WRT:

http://www.dd-wrt.com/wiki/index.php/Easy_SSH_tunnels#Introduction

 

[russdyer]

I have tried opening up 445 on the router as well. Still nothing.

Code:

Forwarded connection refused by server: Administratively prohibited [open failed]

I've read that this error can happen when your account doesn't have forwarding enabled. How can you edit an account to allow forwarding?

Code:

The tunnel needs an endpoint to decode and then forward on the local network. You can use your router to do that, but I'll bet it's not setup for it. I think what's happening now is your router is just forwarding the tunnel to your FreeNAS box and FreeNAS doesn't know what to do.

Ok, so do you know what has to be done after this? How do you get FreeNAS to listen to requests? It's just that no of this was covered in the guide so I didn't think it would be needed. Any help would be appreciated.

 

[ProtoSD]

Take a look at that link I posted above for setup on your router. You don't need to do the Putty part. I'm trying to finish up some other stuff right now, so I can't look at this too much right now. You will probably have make some minor changes to the Putty config you saved already after setting up your router. I think you might have most of the router stuff done on that link, but I just can't dig into it much right now to be sure, sorry.

 

[ProtoSD]

Hi Russ,

Sorry I couldn't help you earlier. Here's what I think you should try:

Load the saved config in Putty
Anywhere in the original instruction, replace beuk.nikhef.nl with the external IP of your router & the port number they tell you to use
Save the config again.

On the services tab for your router:

SSHdEnable Enable
SSH TCP Forwarding Enable
Password Login Enable
Port(Default: 22) Set to 445

Configure the network share like they describe, but just use your username/password (if any) for the CIFS share on FreeNAS.
I have a feeling there might be more, but see what happens.

 

[russdyer]

No problem, I appreciate all the help. Hopefully, together we can figure this out. I tried your suggestions, but it doesn't seem to help. So I changed the Services section, but when replacing beuk.nikhef.nl with the external address, it starts the following error before even try to connect to \\10.255.255.1

Code:

Forwarded connection refused by server: Administratively prohibited [open failed]

 

[ProtoSD]

I'm curious how you're testing this, are you connecting from a completely different external network than your router is on? I'm not trying to imply you don't know what you're doing, just trying to get a clear picture. If you're trying to test from your local network and looping back in, this could be a problem. Also, it would be helpful to confirm the

.... that the portproxy was applied successfully by checking the open ports on the system. Type in the command console
netstat -an | find ":445 "
You should see something like
TCP 10.255.255.1:445 0.0.0.0:0 LISTENING
If you see '0.0.0.0:445' instead then the 'portproxy' rule was not applied correctly.

part of the instructions. The beuk.nikhef.nl part should definitely be changed to your external IP address.

The

Forwarded connection refused by server: Administratively prohibited [open failed]

tells me that your router (the server) refused the connection. If you have the password authentication enabled, when you connect with Putty, I think you should be prompted to login to your router before it'll accept the tunnel connection. That's what happens when I connect with the Putty/tunnel connection I was using this summer. Take a look at the DD-WRT link above again and compare the settings they tell you to set with the ones from the tutorial and look at the logging in part. Actually, you should be able to ssh to your external IP address and tell Putty to use port 445 instead of 22. If that works you should get a login prompt and be able to access your router. Try setting up another Putty test configuration and follow the instructions in that link above and see what happens when you try to connect to your router from outside your local network (use 445 where they say 443).

Sorry I'm just throwing ideas. I hope all that made sense and you can get something useful from it to get you on the right track.