Sample Header Ad - 728x90

Has something changed in Ventura/recent version of MacOS with respect to ssh tunnels? Can't tunnel VNC nor SMB despite SSH working as expected

0 votes
0 answers
380 views
I connect ssh like this: % ssh -L 1445:127.0.0.1:445 -L 15900:127.0.0.1:5900 -p 2216 -v myhost Excerpt from the verbose log when connecting: debug1: Local connections to LOCALHOST:1445 forwarded to remote address 127.0.0.1:445 debug1: Local forwarding listening on ::1 port 1445. debug1: channel 0: new [port listener] debug1: Local forwarding listening on 127.0.0.1 port 1445. debug1: channel 1: new [port listener] debug1: Local connections to LOCALHOST:15900 forwarded to remote address 127.0.0.1:5900 debug1: Local forwarding listening on ::1 port 15900. debug1: channel 2: new [port listener] debug1: Local forwarding listening on 127.0.0.1 port 15900. debug1: channel 3: new [port listener] debug1: channel 4: new [client-session] … debug1: Connection to port 15900 forwarding to 127.0.0.1 port 5900 requested. (no corresponding line for SMB/445) When I then try to connect VNC using this (from the command line) open vnc://127.0.0.1:15900 the connection dialogue appears but after I enter my details it just "shakes" (no error message or anything). For SMB I use a similar URL open smb://127.0.0.1:1445 Here I at least get an error message that a problem occurred and that I should contact the admin. Both VNC and SMB works when I connect directly when I am on the LAN, and I used to do this frequently some years ago. A verbose ssh log from a VNC-attempt: debug1: Connection to port 15900 forwarding to 127.0.0.1 port 5900 requested. debug1: channel 5: new [direct-tcpip] debug1: Connection to port 15900 forwarding to 127.0.0.1 port 5900 requested. debug1: channel 6: new [direct-tcpip] debug1: channel 5: free: direct-tcpip: listening port 15900 for 127.0.0.1 port 5900, connect from 127.0.0.1 port 51566 to 127.0.0.1 port 15900, nchannels 7 debug1: Connection to port 15900 forwarding to 127.0.0.1 port 5900 requested. debug1: channel 5: new [direct-tcpip] debug1: channel 6: free: direct-tcpip: listening port 15900 for 127.0.0.1 port 5900, connect from 127.0.0.1 port 51567 to 127.0.0.1 port 15900, nchannels 7 debug1: channel 5: free: direct-tcpip: listening port 15900 for 127.0.0.1 port 5900, connect from 127.0.0.1 port 51569 to 127.0.0.1 port 15900, nchannels 6 and for SMB: debug1: Connection to port 1445 forwarding to 127.0.0.1 port 445 requested. debug1: channel 5: new [direct-tcpip] debug1: channel 5: free: direct-tcpip: listening port 1445 for 127.0.0.1 port 445, connect from 127.0.0.1 port 51578 to 127.0.0.1 port 1445, nchannels 6 One odd detail is that, for VNC, I have two users on the destination machine, A and B. A is my main user and the user I am logged in as when I try to tunnel VNC over SSH and fail, **BUT** if I instead try to login as B over VNC (while A is logged in locally), the connection works. An SSH-log from such a login: debug1: Connection to port 15900 forwarding to 127.0.0.1 port 5900 requested. debug1: channel 5: new [direct-tcpip] debug1: Connection to port 15900 forwarding to 127.0.0.1 port 5900 requested. debug1: channel 6: new [direct-tcpip] debug1: channel 5: free: direct-tcpip: listening port 15900 for 127.0.0.1 port 5900, connect from 127.0.0.1 port 51642 to 127.0.0.1 port 15900, nchannels 7 debug1: Connection to port 15900 forwarding to 127.0.0.1 port 5900 requested. debug1: channel 5: new [direct-tcpip] debug1: channel 6: free: direct-tcpip: listening port 15900 for 127.0.0.1 port 5900, connect from 127.0.0.1 port 51643 to 127.0.0.1 port 15900, nchannels 7 Trying to login as B over SMB yields the same error message as A sees. I have three computers and I have the same problem with all of them. I use ssh-keys with https://www.funtoo.org/Funtoo:Keychain . If I tunnel over my LAN I get the same result. Feels like something has changed in recent versions of MacOS? An odd detail is that I, when I SSH over internet, need to ctrl-c to exit the connection. That is, after I enter exit to logout something gets stuck in the logout process. It is not until I send a ctrl-c that it finishes and I am returned to my local shell. This does not happen when I SSH on the LAN, in that case I just enter exit and the connection is stopped as expected. --- Update: Here is a log from a failed, tunneled, VNC-login according to the instructions in a comment: 2023-08-18 08:52:05.095119+0200 0xe3cc3b Default 0x0 98235 0 screensharingd: SendAuthenticationInfoMessage 2023-08-18 08:52:05.126178+0200 0xe3cc3b Default 0x0 98235 0 screensharingd: HandleViewerAuthenticationMessages 2 2023-08-18 08:52:05.126193+0200 0xe3cc3b Default 0x0 98235 0 screensharingd: SendRSAResponseSRPAuthentication 2023-08-18 08:52:05.306678+0200 0xe3cc3b Default 0x0 98235 0 screensharingd: HandleViewerAuthenticationMessages 10 2023-08-18 08:52:05.306684+0200 0xe3cc3b Default 0x0 98235 0 screensharingd: SendRSAResponseSRPAuthentication and here a successful login (not tunneled): 2023-08-18 08:47:05.720064+0200 0xe3b74b Default 0x0 97627 0 screensharingd: HandleViewerAuthenticationMessages 2 2023-08-18 08:47:05.720072+0200 0xe3b74b Default 0x0 97627 0 screensharingd: HandleViewerAuthenticationMessages 7 2023-08-18 08:47:06.058599+0200 0xe3b74b Default 0x0 97627 0 screensharingd: HandleViewerAuthenticationMessages 7 2023-08-18 08:47:06.375293+0200 0xe3b4d8 Default 0x0 97627 0 screensharingd: Authentication: SUCCEEDED :: User Name: db :: Viewer Address: 192.168.1.13 :: Type: Kerberos Can't see anything obvious that is wrong/different here?
Asked by d-b (3494 rep)
Aug 16, 2023, 06:40 AM
Last activity: Aug 18, 2023, 06:55 AM