Mac Forum / Country Specific / UK Mac Group / October 2003

On 8/10/03 8:58 pm, in article
1g2j3ii.svwsm4dldm7gN%real-not-anti-spam-address@apple-juice.co.uk, "D.M.
Procida" <real-not-anti-spam-address@apple-juice.co.uk> wrote:

Essentially (on your Mac) you want to use the mount command, with the -t
parameter being "afp". You also need a URL describing the AFP share, which
looks like "afp://[user[;AUTH=uamname][:password]@]host[:port]/volumename".
The mount program will end up calling mount_afp, so try 'man mount' and 'man
mount_afp'.

If that doesn't work, try using the scp command to copy files across
directly. (If you can ssh from one box to the other, scp will also work.)

Cheers,

Chris

In article
<1g2j3ii.svwsm4dldm7gN%real-not-anti-spam-address@apple-juice.co.uk>,

The best way is to use the PPTP server that is part of SME. Then use the
built-in PPTP client in OSX to connect to it: Internet Connect/New VPN
Window; enter WAN IP, username, password, press "connect" and with any luck
you'll have a VPN to your office.

At this point everything is routed via the VPN (the built-in OSX client is
pretty dumb), however, this can be to your advantage. The PPTP server will
allocate you an addr in the office's LAN range, you'll switch to using the
DNS there and to all intents and purposes you'll appear to be connected via
a very long cable to your office LAN only slower.  Well, almost. Alas, you
won't "see" the servers appear in the browser because neither AppleTalk
traffic nor broadcasts are sent through the VPN, however, you can type their
LAN IPs in the "address" field (eg afp://192.168.x.y) and login. The tunnels
are bi-directional, so once connected each side can see the other (though
the connecting Mac is allocated an IP addr dynamically and this can make
things difficult).

If this is too much hassle, I'd be more than happy to sell you a pair of our
firewall/VPN routers which will establish the VPN tunnel for you and make it
appear as if you had a leased line between the 2 sites.

However, back to your question on how to use ssh to do this. I take it you
don't want to be sudo'ing all the time. In that case,

1) If you have run ssh at least once, there will be a hidden directory
".ssh" in your home folder. If not, run ssh and let it create it for you
(best way, since it's pretty fussy about the permissions on it).

2) Now using any text editor, create a file called "config" in that
directory (ie ~/.ssh/config).

3) The contents of the file should look like this:

Host apple-juice
Hostname [ip_or_FQDN]
User [your_username]
LocalForward 1548 localhost:548

4) Now open a terminal window and type

ssh -N -f apple-juice

enter password and it will run in the background until you kill it or log
off.

5) Go to the Finder, do cmd-K and enter

afp://127.0.0.1:1548

in the address field and you will be connected to the AFP server at the
office.

You can have as many "Host" stanzas as you want; they don't have to do any
fowarding and can just act as shortcuts for the ip addr/username combo. You
can also forward more than one port in the same stanza; eg if you add

LocalForward 1180 localhost:80

to the above, then browse to http://127.0.0.1:1180 you will be connected to
the webmin page of your SME server. (Need to kill the bkg ssh process you
started earlier then rerun or it won't see the change.)

Using local port numbers above 1024 means you don't have to be root, but if
you don't mind sudo'ing you can use the std port numbers.

You can also forward ports to a 3rd party. This comes in useful if I'm on a
client's site and another client has a crisis. His firewall will allow my IP
range through but of course not the IP range of the site where I'm at. By
adding a port-forward like so:

LocalForward 2280 clients_IP:80

and browsing to http://127.0.0.1:2280

my connection is routed via my Linux box and allowed through client 2's
firewall as it will appear to come from my IP range. Of course, I'd usually
use PPTP, but some sites block it (or have broken routers/firewalls).

Finally, you don't need the .ssh/config file as you can enter all the necc
params on the cmd line (do "man ssh" and check out the "-L" option); just
saves you a lot of typing...