Re: AFS via SSH tunnel
Andreas Haupt <[email protected]> Wed, 02 Jul 2025 09:29:21 +0200
| Newsgroups | gmane.comp.file-systems.openafs.general |
|---|---|
| Organization | DESY |
| Message-ID | <[email protected]> |
--=-ShcfpOqHrHj6LOJPdBze Content-Type: multipart/alternative; boundary="=-aFBwIKX3uYurCH09RkL9" --=-aFBwIKX3uYurCH09RkL9 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi, although maybe a bit more complicated, I managed to make AFS client work with sshuttle (tproxy mode). Callbacks sent by the servers might be an issue, though. Cheers, Andreas On Sun, 2025-06-29 at 20:25 -0400, Ernesto Alfonso wrote: > I have an AFS server at home that's not exposed to the public > internet. When I'm not home, occasionally I'd like to have secure > access to the file system. >=20 > At first I tried to VPN into my home network to have access to the > AFS server as a local host, but I'm having trouble setting this up > right now for reasons not related to AFS--some openvpn server issue > where I'm able to establish the VPN connection but unable to see any > other hosts except the VPN server itself. >=20 > My current attempt is to use SSH to forward all the relevant openafs > ports as local services, and then try to trick my AFS client into > connecting to 127.0.0.1. I'm forwarding the ports 88, 7000-7007, > using a command similar to this: >=20 > =C2=A0 =C2=A0 ssh -N myhome.com -L 88:afsserver:88 -L 7000:afsserver:7000= -L > 7001:afsserver:7001 -L 7002:afsserver:7002 -L 7003:afsserver:7003 -L > 7004:afsserver:7004 -L 7005:afsserver:7005 -L 7006:afsserver:7006 -L > 7007:afsserver:7007 >=20 > myhome.com is an intermediate host that exposes an SSH server, and > can locally access afsserver.local. The ports are forwarded to my > laptop's localhost. I then manipulate /etc/hosts to name 127.0.0.1 as > afsserver, and I also update CellServDB. >=20 > After this, I try to run=C2=A0kinit myuser && aklog -d >=20 > The kinit command succeeds, but aklog -d fails, curiously with exit > status 0. >=20 > =C2=A0 =C2=A0=C2=A0 > =C2=A0 =C2=A0 $ aklog -d > =C2=A0 =C2=A0 Authenticating to cell afs.example.com (server afs.example.= com). > =C2=A0 =C2=A0 Trying to authenticate to user's realm AFS.EXAMPLE.COM. > =C2=A0 =C2=A0 Getting tickets: afs/[email protected] > =C2=A0 =C2=A0 Using Kerberos V5 ticket natively > =C2=A0 =C2=A0 About to resolve name admin to id in cell afs.example.com. > =C2=A0 =C2=A0 Error -1 > =C2=A0 =C2=A0 Setting tokens. admin @ afs.example.com > =C2=A0 =C2=A0 =E2=96=88[laptop][Downloads][0]$ >=20 > I'm also unable to read any AFS files: >=20 > =C2=A0 =C2=A0 cat /afs/afs.example.com/public/hola > =C2=A0 =C2=A0 cat: /afs/afs.example.com/public/hola: Connection timed out >=20 > How should human users of AFS interpret this "Error -1", and what can > I do about it?=C2=A0 >=20 > I would also welcome suggestions as to how to alternative ways to > achieve my original goal, though I wouldn't feel inclined to open up > all the AFS ports directly to the public. >=20 > Thanks, >=20 > Ernesto --=20 | Andreas Haupt | E-Mail: [email protected] | DESY, Zeuthen | WWW: http://www.zeuthen.desy.de/~ahaupt | Platanenallee 6 | Phone: +49/33762/7-7359 | D-15738 Zeuthen | --=-aFBwIKX3uYurCH09RkL9 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable <html><head></head><body><div>Hi,</div><div><br></div><div>although maybe a= bit more complicated, I managed to make AFS client work with sshuttle (tpr= oxy mode). Callbacks sent by the servers might be an issue, though.</div><d= iv><br></div><div>Cheers,</div><div>Andreas</div><div><br></div><div>On Sun= , 2025-06-29 at 20:25 -0400, Ernesto Alfonso wrote:</div><blockquote type= =3D"cite" style=3D"margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding= -left:1ex"><div dir=3D"ltr">I have an AFS server at home that's not exposed= to the public internet. When I'm not home, occasionally I'd like to have s= ecure access to the file system.<div><br></div><div>At first I tried to VPN= into my home network to have access to the AFS server as a local host, but= I'm having trouble setting this up right now for reasons not related to AF= S--some openvpn server issue where I'm able to establish the VPN connection= but unable to see any other hosts except the VPN server itself.</div><div>= <br></div><div>My current attempt is to use SSH to forward all the relevant= openafs ports as local services, and then try to trick my AFS client into = connecting to 127.0.0.1. I'm forwarding the ports 88, 7000-7007, using a co= mmand similar to this:</div><div><br></div><div> ssh -N <a hre= f=3D"http://myhome.com">myhome.com</a> -L 88:afsserver:88 -L 7000:afsserver= :7000 -L 7001:afsserver:7001 -L 7002:afsserver:7002 -L 7003:afsserver:7003 = -L 7004:afsserver:7004 -L 7005:afsserver:7005 -L 7006:afsserver:7006 -L 700= 7:afsserver:7007</div><div><br></div><div><a href=3D"http://myhome.com">myh= ome.com</a> is an intermediate host that exposes an SSH server, and can loc= ally access afsserver.local. The ports are forwarded to my laptop's localho= st. I then manipulate /etc/hosts to name 127.0.0.1 as afsserver, and I also= update CellServDB.</div><div><br></div><div>After this, I try to run = <span style=3D"color:rgb(0,0,0);font-family:monospace">kinit myuser &&a= mp; aklog -d</span></div><br><div><font face=3D"monospace">The kinit comman= d succeeds, but aklog -d fails, curiously with exit status 0.</font></div><= div><br></div> <br> $ aklog -d<br> &nb= sp; Authenticating to cell <a href=3D"http://afs.example.com">afs.example.c= om</a> (server <a href=3D"http://afs.example.com">afs.example.com</a>).<br>= Trying to authenticate to user's realm <a href=3D"http://AFS.= EXAMPLE.COM">AFS.EXAMPLE.COM</a>.<br> Getting tickets: afs/<a = href=3D"mailto:[email protected]">[email protected]= .COM</a><br> Using Kerberos V5 ticket natively<br>  = ; About to resolve name admin to id in cell <a href=3D"http://afs.example.c= om">afs.example.com</a>.<br> Error -1<br> Setting= tokens. admin @ <a href=3D"http://afs.example.com">afs.example.com</a><br>= <div> =E2=96=88[laptop][Downloads][0]$</div><div><br></div><di= v>I'm also unable to read any AFS files:</div><div><br></div><div> &n= bsp; cat /afs/<a href=3D"http://afs.example.com/public/hola">afs.example.co= m/public/hola</a></div><div> cat: /afs/<a href=3D"http://afs.e= xample.com/public/hola">afs.example.com/public/hola</a>: Connection timed o= ut</div><div><br></div><div>How should human users of AFS interpret this "E= rror -1", and what can I do about it? </div><div><br></div><div>I woul= d also welcome suggestions as to how to alternative ways to achieve my orig= inal goal, though I wouldn't feel inclined to open up all the AFS ports dir= ectly to the public.</div><div><br></div><div>Thanks,</div><div><br></div><= div>Ernesto</div></div></blockquote><div><br></div><div><span><pre>-- <br><= /pre><pre>| Andreas Haupt | E-Mail: [email protected] | DESY, Zeuthen | WWW: http://www.zeuthen.desy.de/~ahaupt | Platanenallee 6 | Phone: +49/33762/7-7359 | D-15738 Zeuthen | </pre></span></div></body></html> --=-aFBwIKX3uYurCH09RkL9-- --=-ShcfpOqHrHj6LOJPdBze Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Disposition: attachment; filename="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgIFADCABgkqhkiG9w0BBwEAAKCCDjQw ggbmMIIEzqADAgECAhAxAnDUNb6bJJr4VtDh4oVJMA0GCSqGSIb3DQEBDAUAMIGIMQswCQYDVQQG EwJVUzETMBEGA1UECBMKTmV3IEplcnNleTEUMBIGA1UEBxMLSmVyc2V5IENpdHkxHjAcBgNVBAoT FVRoZSBVU0VSVFJVU1QgTmV0d29yazEuMCwGA1UEAxMlVVNFUlRydXN0IFJTQSBDZXJ0aWZpY2F0 aW9uIEF1dGhvcml0eTAeFw0yMDAyMTgwMDAwMDBaFw0zMzA1MDEyMzU5NTlaMEYxCzAJBgNVBAYT Ak5MMRkwFwYDVQQKExBHRUFOVCBWZXJlbmlnaW5nMRwwGgYDVQQDExNHRUFOVCBQZXJzb25hbCBD QSA0MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAs0riIl4nW+kEWxQENTIgFK600jFA xs1QwB6hRMqvnkphfy2Q3mKbM2otpELKlgE8/3AQPYBo7p7yeORuPMnAuA+oMGRb2wbeSaLcZbpw XgfCvnKxmq97/kQkOFX706F9O7/h0yehHhDjUdyMyT0zMs4AMBDRrAFn/b2vR3j0BSYgoQs16oSq adM3p+d0vvH/YrRMtOhkvGpLuzL8m+LTAQWvQJ92NwCyKiHspoP4mLPJvVpEpDMnpDbRUQdftSpZ zVKTNORvPrGPRLnJ0EEVCHR82LL6oz915WkrgeCY9ImuulBn4uVsd9ZpubCgM/EXvVBlViKqusCh SsZEn7juIsGIiDyaIhhLsd3amm8BS3bgK6AxdSMROND6hiHT182Lmf8C+gRHxQG9McvG35uUvRu8 v7bPZiJRaT7ZC2f50P4lTlnbLvWpXv5yv7hheO8bMXltiyLweLB+VNvg+GnfL6TW3Aq1yF1yrZAZ zR4MbpjTWdEdSLKvz8+0wCwscQ81nbDOwDt9vyZ+0eJXbRkWZiqScnwAg5/B1NUD4TrYlrI4n6zF p2pyYUOiuzP+as/AZnz63GvjFK69WODR2W/TK4D7VikEMhg18vhuRf4hxnWZOy0vhfDR/g3aJbds Gac+diahjEwzyB+UKJOCyzvecG8bZ/u/U8PsEMZg07iIPi8CAwEAAaOCAYswggGHMB8GA1UdIwQY MBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRpAKHHIVj44MUbILAK3adRvxPZ5DAO BgNVHQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHSUEFjAUBggrBgEFBQcDAgYI KwYBBQUHAwQwOAYDVR0gBDEwLzAtBgRVHSAAMCUwIwYIKwYBBQUHAgEWF2h0dHBzOi8vc2VjdGln by5jb20vQ1BTMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VS VHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDB2BggrBgEFBQcBAQRqMGgwPwYIKwYB BQUHMAKGM2h0dHA6Ly9jcnQudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FBZGRUcnVzdENBLmNy dDAlBggrBgEFBQcwAYYZaHR0cDovL29jc3AudXNlcnRydXN0LmNvbTANBgkqhkiG9w0BAQwFAAOC AgEACgVOew2PHxM5AP1v7GLGw+3tF6rjAcx43D9Hl110Q+BABABglkrPkES/VyMZsfuds8fcDGvG E3o5UfjSno4sij0xdKut8zMazv8/4VMKPCA3EUS0tDUoL01ugDdqwlyXuYizeXyH2ICAQfXMtS+r az7mf741CZvO50OxMUMxqljeRfVPDJQJNHOYi2pxuxgjKDYx4hdZ9G2o+oLlHhu5+anMDkE8g0tf fjRKn8I1D1BmrDdWR/IdbBOj6870abYvqys1qYlPotv5N5dm+XxQ8vlrvY7+kfQaAYeO3rP1DM8B GdpEqyFVa+I0rpJPhaZkeWW7cImDQFerHW9bKzBrCC815a3WrEhNpxh72ZJZNs1HYJ+29NTB6uu4 NJjaMxpk+g2puNSm4b9uVjBbPO9V6sFSG+IBqE9ckX/1XjzJtY8Grqoo4SiRb6zcHhp3mxj3oqWi 8SKNohAOKnUc7RIP6ss1hqIFyv0xXZor4N9tnzD0Fo0JDIURjDPEgo5WTdti/MdGTmKFQNqxyZuT 9uSI2Xvhz8p+4pCYkiZqpahZlHqMFxdw9XRZQgrP+cgtOkWEaiNkRBbvtvLdp7MCL2OsQhQEdEbU vDM9slzZXdI7NjJokVBq3O4pls3VD2z3L/bHVBe0rBERjyM2C/HSIh84rfmAqBgklzIOqXhd+4Rz adUwggdGMIIFLqADAgECAhEAra/kSKV1AoCk06wfRY3CLTANBgkqhkiG9w0BAQwFADBGMQswCQYD VQQGEwJOTDEZMBcGA1UEChMQR0VBTlQgVmVyZW5pZ2luZzEcMBoGA1UEAxMTR0VBTlQgUGVyc29u YWwgQ0EgNDAeFw0yNDExMTMwMDAwMDBaFw0yNjExMTMyMzU5NTlaMIG/MQswCQYDVQQGEwJERTEQ MA4GA1UECBMHSGFtYnVyZzEuMCwGA1UEChMlRGV1dHNjaGVzIEVsZWt0cm9uZW4tU3luY2hyb3Ry b24gREVTWTEOMAwGA1UEYRMFR09WREUxJDAiBgkqhkiG9w0BCQEWFWFuZHJlYXMuaGF1cHRAZGVz eS5kZTEOMAwGA1UEBBMFSGF1cHQxEDAOBgNVBCoTB0FuZHJlYXMxFjAUBgNVBAMTDUFuZHJlYXMg SGF1cHQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCpO6QZmT8g4US0YUiFzCUuHKB7 6GFcxtRzjViRUVB9kFyliIVlJ6Orfb6ttgXFeJ3xw4hGhTZUJLkV9rcWb/bKuOEER1rTGUDWU9K/ rRBNH6QbsZSlLKJPODwQfbHEqiZVgzuLGBgt6D1iEnbu36BY5y21K7O1KcH3DBLj6KWBf+SjEbVH io4hMvhv42BC2bE3HTLafI4MrKXF4rWw0z8i9Xu2iRNAsjELLU2GGAXJYAnOHjQQ9iRbal1bi8MH /ISjyO3rffhWfWi1hgikrkIi6GHM2jvNPEIS/Xwp1fOX0Y99toPFrM4SF70cMI9TNzuKl5aNkGAB 7AlmViy/behaSWcdFD71Nxocl9ETw8JYNjM9Es3ugdZbfrIzy2m8bIN3iK9uff6LHkOSUYQfDvgu HQOXZigEe/XMtQKdicLK4KlFvAl+rUV6zPdyOjjbJDyXCWPZifjCbvkd5R3XP4YOUNTN9C2jgXcL nbqX7ozP4qD4jNRiAbE0JN2R4w7likLuSQiZ8G7Jb5yBt0pBF77YO961ra0C0B34tCKzwhEuMUbK VesxFZInvMyVImyuplIbFBH5rPk77oclQOnDS2C0sx8JseNVGKCP56gTTQOLapkS/MH0OdV1gFPf d9ws5bf1e6bKIlVuJl9HF/oT/0B9VzPRqOo/2jlSZzO9RViTuQIDAQABo4IBszCCAa8wHwYDVR0j BBgwFoAUaQChxyFY+ODFGyCwCt2nUb8T2eQwHQYDVR0OBBYEFKdKweAk+c0OGX1eL8A0Qjl+X4UL MA4GA1UdDwEB/wQEAwIFoDAMBgNVHRMBAf8EAjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEF BQcDAjBQBgNVHSAESTBHMDoGDCsGAQQBsjEBAgEKBDAqMCgGCCsGAQUFBwIBFhxodHRwczovL3Nl Y3RpZ28uY29tL1NNSU1FQ1BTMAkGB2eBDAEFAwIwQgYDVR0fBDswOTA3oDWgM4YxaHR0cDovL0dF QU5ULmNybC5zZWN0aWdvLmNvbS9HRUFOVFBlcnNvbmFsQ0E0LmNybDB4BggrBgEFBQcBAQRsMGow PQYIKwYBBQUHMAKGMWh0dHA6Ly9HRUFOVC5jcnQuc2VjdGlnby5jb20vR0VBTlRQZXJzb25hbENB NC5jcnQwKQYIKwYBBQUHMAGGHWh0dHA6Ly9HRUFOVC5vY3NwLnNlY3RpZ28uY29tMCAGA1UdEQQZ MBeBFWFuZHJlYXMuaGF1cHRAZGVzeS5kZTANBgkqhkiG9w0BAQwFAAOCAgEAW0hfwzYY/GSzTFAx vOVO0ay0OwCCffxcM+J63Dhhgt8GaU53kt1Qk0mUaajayQiOKG99D7XRqKCqh5CTM4M9v9iF5k4/ kZwA0Yn38NiJq7BZqCAULfrszyVb/eQgf+nEfHPJMtBecezvN1I+xzV4/uBcDwBro9Twx/4ZycUq jqYvCGVKWlVFgPSxfzIKfIfSCGeTXRFvsEFgK1cuuRF4kSK9Yre18+JkH927a9hXFbkBoC4sAhi9 P6NlCzVxdf2lRzBxg2/ZiYllJZxsMP+fOR7AP8DShPwFSMyWthnluuEvkGXN/I3BFgLN5y3NuSq/ WUzSghwowZLaKR+BZ0bpHufSFr/7FGpkIzC4XOWFknnWQ9UIMas1dRx1DgPTiIJoojYlG6B+PG4e ehtc5l9x+siQ5SE8XaJZZXN5xO6wk7I+YBNxN3ogtx8yCDg5V4ggwc55x47Q+PSqMsTEqI7P7UjN QVOo5XuZHdzOOOOcfviuChiY+cPb1azcaMMmvhK+/AI764twX0pkwp5nvcYrs2BW9wwdQrnSLfSJ EcEc1hbQMJcdB/m6YFr0K9rC/V8VnQMTVew0pCtAPpr32ki1YP4Fv4CRErpu23GDJbS7nAeCpdeR Wf+pD94z4WbNR0pl+zvJ1q0eXz5z6rTa2k8ht/dpTisoT+AV6+KijMU05kMxggMBMIIC/QIBATBb MEYxCzAJBgNVBAYTAk5MMRkwFwYDVQQKExBHRUFOVCBWZXJlbmlnaW5nMRwwGgYDVQQDExNHRUFO VCBQZXJzb25hbCBDQSA0AhEAra/kSKV1AoCk06wfRY3CLTANBglghkgBZQMEAgIFAKB5MBgGCSqG SIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTI1MDcwMjA3MjkyMVowPwYJKoZI hvcNAQkEMTIEMNOf7GOKjNOyUUKSwBwkt60sk5K07WxfDsafkrcnWcVcbVK8MyTGVym4cPh9cIXk cDANBgkqhkiG9w0BAQEFAASCAgBwwRi9HhGU0yXLOu2Eq4S/aPdFu8xJI5BNB52qzMCbiykZbf0Q b7Vcm9KfKvq75QVkmyIKCi0S2PdbMoqEBBFRffDKIS/TaAWEsxmHptkNpH9UmOUpAZvVdRpdKDnT IO6hpwLa+Yflm0tZPGruJrSiV9AYtzF+0v1U4qabpNF4G3z2btIh9E+Vvp7uhhGnAgk+9k70qzFU z3Bin/Q763x1lrGkwnpMpaHdvaw1RIbiz05BHsZNRDDFVYupisbwNQTbhqaEKWcCpXxsL9yi2Zic YQeR+Cvc7BwhTGxJgsXIYjFJmc0AVCM6SFTfiUuODS85F0XT5jgUowBnU5DmTQ+jqZSGe0pcrdQD 5QwDLEdBEYQn3URlatIJ69sMTD47U2MmU67dQGFRehah7D7ggkgtj4XtEigTbUzF7AdunhYVFGHy vidRWDe8OLHWCpuFeLWV+6qBEV2LJRl+YHKOxAZaDdGOGY8p9Pj0pQBy5B35VQJMWovTmM0XD4Yo 1TZj8KK0Le7VdORAj5mSCkgQDsmGtc2NaN7spKkclFHdQDMVJlU+EGYRS0X9Fcz0/dovVnRy1/aY /xj2RBPYArxFbtM238URPmmee82GVcC0QUHuVles0uyyFIC9GiUZARY/wHz3cZsWZj3fWh7uXPkp LCX4wZ3yECauNgohC+wTB/gRjgAAAAAAAA== --=-ShcfpOqHrHj6LOJPdBze--