0

I connect ssh like this:

% ssh -L 1445:127.0.0.1:445 -L 15900:127.0.0.1:5900 -p 2216 -v myhost

Excerpt from the verbose log when connecting:

debug1: Local connections to LOCALHOST:1445 forwarded to remote address 127.0.0.1:445
debug1: Local forwarding listening on ::1 port 1445.
debug1: channel 0: new [port listener]
debug1: Local forwarding listening on 127.0.0.1 port 1445.
debug1: channel 1: new [port listener]
debug1: Local connections to LOCALHOST:15900 forwarded to remote address 127.0.0.1:5900
debug1: Local forwarding listening on ::1 port 15900.
debug1: channel 2: new [port listener]
debug1: Local forwarding listening on 127.0.0.1 port 15900.
debug1: channel 3: new [port listener]
debug1: channel 4: new [client-session]

debug1: Connection to port 15900 forwarding to 127.0.0.1 port 5900 requested.

(no corresponding line for SMB/445)

When I then try to connect VNC using this (from the command line)

open vnc://127.0.0.1:15900

the connection dialogue appears but after I enter my details it just "shakes" (no error message or anything).

For SMB I use a similar URL

open smb://127.0.0.1:1445

Here I at least get an error message that a problem occurred and that I should contact the admin. Both VNC and SMB works when I connect directly when I am on the LAN, and I used to do this frequently some years ago.

A verbose ssh log from a VNC-attempt:

debug1: Connection to port 15900 forwarding to 127.0.0.1 port 5900 requested.
debug1: channel 5: new [direct-tcpip]
debug1: Connection to port 15900 forwarding to 127.0.0.1 port 5900 requested.
debug1: channel 6: new [direct-tcpip]
debug1: channel 5: free: direct-tcpip: listening port 15900 for 127.0.0.1 port 5900, connect from 127.0.0.1 port 51566 to 127.0.0.1 port 15900, nchannels 7
debug1: Connection to port 15900 forwarding to 127.0.0.1 port 5900 requested.
debug1: channel 5: new [direct-tcpip]
debug1: channel 6: free: direct-tcpip: listening port 15900 for 127.0.0.1 port 5900, connect from 127.0.0.1 port 51567 to 127.0.0.1 port 15900, nchannels 7
debug1: channel 5: free: direct-tcpip: listening port 15900 for 127.0.0.1 port 5900, connect from 127.0.0.1 port 51569 to 127.0.0.1 port 15900, nchannels 6

and for SMB:

debug1: Connection to port 1445 forwarding to 127.0.0.1 port 445 requested.
debug1: channel 5: new [direct-tcpip]
debug1: channel 5: free: direct-tcpip: listening port 1445 for 127.0.0.1 port 445, connect from 127.0.0.1 port 51578 to 127.0.0.1 port 1445, nchannels 6

One odd detail is that, for VNC, I have two users on the destination machine, A and B. A is my main user and the user I am logged in as when I try to tunnel VNC over SSH and fail, BUT if I instead try to login as B over VNC (while A is logged in locally), the connection works. An SSH-log from such a login:

debug1: Connection to port 15900 forwarding to 127.0.0.1 port 5900 requested.
debug1: channel 5: new [direct-tcpip]
debug1: Connection to port 15900 forwarding to 127.0.0.1 port 5900 requested.
debug1: channel 6: new [direct-tcpip]
debug1: channel 5: free: direct-tcpip: listening port 15900 for 127.0.0.1 port 5900, connect from 127.0.0.1 port 51642 to 127.0.0.1 port 15900, nchannels 7
debug1: Connection to port 15900 forwarding to 127.0.0.1 port 5900 requested.
debug1: channel 5: new [direct-tcpip]
debug1: channel 6: free: direct-tcpip: listening port 15900 for 127.0.0.1 port 5900, connect from 127.0.0.1 port 51643 to 127.0.0.1 port 15900, nchannels 7

Trying to login as B over SMB yields the same error message as A sees.

I have three computers and I have the same problem with all of them. I use ssh-keys with https://www.funtoo.org/Funtoo:Keychain. If I tunnel over my LAN I get the same result. Feels like something has changed in recent versions of MacOS?

An odd detail is that I, when I SSH over internet, need to ctrl-c to exit the connection. That is, after I enter exit to logout something gets stuck in the logout process. It is not until I send a ctrl-c that it finishes and I am returned to my local shell. This does not happen when I SSH on the LAN, in that case I just enter exit and the connection is stopped as expected.


Update:

Here is a log from a failed, tunneled, VNC-login according to the instructions in a comment:

2023-08-18 08:52:05.095119+0200 0xe3cc3b   Default     0x0                  98235  0    screensharingd: SendAuthenticationInfoMessage
2023-08-18 08:52:05.126178+0200 0xe3cc3b   Default     0x0                  98235  0    screensharingd: HandleViewerAuthenticationMessages 2
2023-08-18 08:52:05.126193+0200 0xe3cc3b   Default     0x0                  98235  0    screensharingd: SendRSAResponseSRPAuthentication
2023-08-18 08:52:05.306678+0200 0xe3cc3b   Default     0x0                  98235  0    screensharingd: HandleViewerAuthenticationMessages 10
2023-08-18 08:52:05.306684+0200 0xe3cc3b   Default     0x0                  98235  0    screensharingd: SendRSAResponseSRPAuthentication

and here a successful login (not tunneled):

2023-08-18 08:47:05.720064+0200 0xe3b74b   Default     0x0                  97627  0    screensharingd: HandleViewerAuthenticationMessages 2
2023-08-18 08:47:05.720072+0200 0xe3b74b   Default     0x0                  97627  0    screensharingd: HandleViewerAuthenticationMessages 7
2023-08-18 08:47:06.058599+0200 0xe3b74b   Default     0x0                  97627  0    screensharingd: HandleViewerAuthenticationMessages 7
2023-08-18 08:47:06.375293+0200 0xe3b4d8   Default     0x0                  97627  0    screensharingd: Authentication: SUCCEEDED :: User Name: db :: Viewer Address: 192.168.1.13 :: Type: Kerberos

Can't see anything obvious that is wrong/different here?

9
  • There's nothing specifically Apple about SSH. They are using OpenSSH. Type ssh -V to get the current version installed. I'm on Ventura 13.5, with OpenSSH v9.01p1 with no tunnel issues.
    – Allan
    Aug 16, 2023 at 16:53
  • @Allan OpenSSH_9.0p1, LibreSSL 3.3.6 - so what do you think is wrong for me?
    – d-b
    Aug 17, 2023 at 7:17
  • I missed the line where you say the login dialog "shakes." That indicates authentication failed. I would be curios to see the Mac's VNC authentication log entries. See this answer for how to do this. You might want to just try connecting again just to have recent entries rather than searching for them.
    – Allan
    Aug 17, 2023 at 13:11
  • @Allan Updated with the requested logs. What gives?
    – d-b
    Aug 18, 2023 at 6:56
  • 1
    The good news is messages are being sent through the tunnel indicated by the messages responses. However, it doesn't like the authentication for some reason. Are you on a corporate network by any change? The Kerberos authentication jumps out at me.
    – Allan
    Aug 18, 2023 at 13:02

0

You must log in to answer this question.

Browse other questions tagged .