Introduction

This tutorial contains screenshots for the English version of Windows 10. Separate instructions for older versions of Windows are also available:

To be able to mount a Windows share over SSH we will need

  • Administrator access to the local computer, including the ability to elevate privileges. If you don't know what I am talking about then stop reading right here.
  • One real or virtual network adapter, bound to the Client for Microsoft Networks driver.
    Normally you should already have such an adapter, as otherwise you would not be able to mount any Windows shares.
  • One real or virtual network adapter, NOT bound to the Client for Microsoft Networks driver.

This part of the tutorial is split into the following steps:

    1. As most people do not have a spare real network adapter in their computer, we will add an extra virtual network adapter by installing the Microsoft KM-TEST Loopback Adapter.
    2. After that, the network adapter must be properly configured.
    3. Starting with Windows 10 update 1903, the Windows 10 feature "SMB 1.0" must be turned off.
    4. Furthermore, a few Windows system drivers need to be tweaked.
    5. Next, reboot Windows to verify that we've been able to grab port 445 and to see if the lanmanserver driver is up and running.
    6. Finally, we launch a special OpenSSH session and mount our Nikhef home directory.
  1. For those wishing to undo the above steps follow the instructions at the bottom of this tutorial.

Windows 10 Upgrade woes

Multiple persons have reported problems after a major Windows 10 upgrade (e.g. from 1803 to 1809). This is due mostly to the disappearance of the Microsoft KM-TEST Loopback Adapter and of the portproxy rule. In order to recover after a Windows 10 upgrade, try

  • Redo step 1 and reboot
  • If the adapter is still not present, run devmgmt.msc management console application and
    choose View->Show Hidden devices to see you can find the adapter again. If not, redo step 2.
  • Redo steps 3, 4 and 5.

1. Installing the Loopback Adapter

To install the Loopback adapter follow these steps:

  • Start the Add Hardware Wizard by either going Start->Settings->Control Panel->Add Hardware or by starting a console window with elevated (Administrator) privileges. In the console window type

      hdwwiz.exe
    

    The Hardware Wizard will come up:

  • Click Next to continue:

    Select Install the hardware that I manually select from a list and click Next.
  • Now you'll see:

    Select the entry Network adapters and click Next.
  • In the next screen

    first select Microsoft from the list of Manufacturers and then select Microsoft KM-TEST Loopback Adapter from the list of Network Adapters. Finally, click Next once more.
  • Almost finished:

    This is your last chance to abort, otherwise, click Next.
  • After a while you should see:

    Click Finish to exit the Hardware Wizard.

You are now ready to configure your newly installed Loopback adapter. Even though Windows might not ask you to, reboot anyways (heey, it's a Microsoft OS ;-)).
From reports I've seen on the Internet a reboot is sometimes required for the loopback adapter to come up properly.

2. Configuring the Loopback Adapter

Now that your newly installed loopback adapter is up and running we must configure it properly:

  • Go to the Network Connections Center:
  • Choose the loopback adapter (usually it is named something like "Local Area Connection #3") and right-click on it:
  • Choose Properties, after which a new window will appear

    Make sure that
    • the entry Client for Microsoft Networks is NOT enabled, i.e. does not have a checkmark in front of it.
    • the entry File and Printer sharing for Microsoft Networks is NOT enabled, i.e. does not have a checkmark in front of it.
    • the entry Internet Protocol (TCP/IP) is enabled.
  • Select the entry Internet Protocol (TCP/IP), then click on Properties.
  • A new window will appear:

    Select Use the following IP address and fill in the 'IP address' and 'Subnet mask' as above.
    It is not necessary to fill in the 'Default gateway' or a 'DNS server'.
  • Click on Advanced to make the following window appear:

    Deselect Automatic metric and fill in the value of 9999 as the 'Interface metric' as shown above.
  • Click on the WINS tab:

    and select Disable NetBIOS over TCP/IP.
  • Click on OK.
  • You are now back in the main 'TCP/IP Properties' screen. Click OK again.
  • You are now back in the main 'Loopback Properties' screen. Click Close.

3. Disabling the "SMB 1.0" Windows feature

Starting with Windows 10 update 1903 we need to disable the Windows feature SMB 1.0:

  • Go to the Control Panel->Programs->Programs and Features and select Turn Windows features on or off
  • A list of features pops up:

    Scroll down and deselect the feature SMB 1.0/CIFS File Sharing support
  • Now close this control panel item.

(Thanks to Michael Uhlenberg for pointing this out)

4. Tweaking the 'LanmanServer' driver

Now we first need to tweak a Windows system driver to overcome the thing that Microsoft broke. The root cause of the problem is that we need to access the file share using TCP port 445. However, when Windows 10 boots this port is grabbed by the system lanmanserver driver for all interfaces. By delaying the startup of the lanmanserver driver and by installing a portproxy rule we can circumvent this. This section explains how to do this:

  • Start a console window with elevated (Administrator) privileges.
  • First, we disable the automatic starting of the lanmanserver driver:
      sc config lanmanserver start= delayed-auto
    

    NOTE the space after the start= ! Also, if start= delayed-auto does not work then try start= demand

  • Make sure the IpHlpSvc driver is running at startup, as otherwise the portproxy rules are not executed:
      sc config iphlpsvc start= auto
    

    NOTE the space after the start= !
    Thanks to Michael Uhlenberg for pointing out this important driver.

  • Next we add a portproxy rule to reroute TCP port 445 to a port of our choosing. For this tutorial, I choose 44445:
      netsh interface portproxy add v4tov4 listenaddress=10.255.255.1 listenport=445
    connectaddress=10.255.255.1 connectport=44445

    IMPORTANT NOTES:

    • The listenaddress is the address of the Loopback adapter configured in the section earlier
    • The connectaddress must be identical to the listenaddress
    • Using listenaddress=127.0.0.1 does not work. Believe me, I've tried.

If all went well you should see something like

The portproxy rule is persistent, so there should be no need to repeat this step after a reboot.

5. Reboot and verify

Of course, now that we have disabled the automatic startup of the 'LanmanServer' driver we have to reboot Windows before proceeding.

  • Verify that the portproxy was applied successfully by checking the open ports on the system. Type in the command console

      netstat -an | find ":445 "
    

    You should see something like:

    If you see only '0.0.0.0:445' instead then the 'portproxy' rule was not applied correctly. Verify that the right 'portproxy' rule was used

       netsh interface portproxy show v4tov4
    

    and verify that the IpHlpSvc driver is running at Windows startup using

      sc query iphlpsvc
    

    Another reason for the 'port grabbing' to fail could be the LanmanWorkstation driver running at Windows startup. If so, try giving it the same treatment as LanmanServer. However, on the Windows 10 installations I tested this driver was running at system startup without causing any problems.

  • After Windows comes up and you have logged in, check the status of the 'lanmanserver' driver. Open a command console (no privilege elevation is required) and type
      sc query lanmanserver
    

    The 'LanmanServer' driver should be in the state Running. If it is not, then follow these steps to create a task using the Task Schedule to start it at system startup.

On Windows 10 things are slightly different compared to Windows 7 and 8; it seems that Microsoft has read my tutorial and decided to provide a way to use local shares again ;-) !

6. Putting it all together

Now that we have configured both our loopback adapter we can put it all together by launching a special OpenSSH connection and mounting our Nikhef home directory as a Windows share:

  • Launch an OpenSSH session with some special port-forwarding rules and login on login2.nikhef.nl as normal. Open a Command console or terminal and type:

      ssh -v -N -n -L 10.255.255.1:44445:beuk.nikhef.nl:445 <Your-nikhef-userid>@login2.nikhef.nl
    

    Yes, there are lots of colons in that -L option but you need them all.

  • The first time you start the command with the special port forwarding rules, you will be (probably) be prompted by the Windows Defender Firewall that it has blocked some features:

    Allow access to at least Public networks by ticking the checkbox, then click on Allow access as otherwise the port-forwarding will not work.
  • Make sure port-forwarding is working properly by checking the (verbose) log:

    Make sure the line
      debug1: Local connections to 10.255.255.1:44445 forwarded to remote address beuk.nikhef.nl:445
    

    is present before continuing.

  • Go to Start->Run and type \\10.255.255.1\user\<Your-nikhef-userid>
  • In the Console window you should now see a line
      debug1: Connection to port 44445 forwarding to beuk.nikhef.nl:445 requested.
    

    as in the following screenshot:

    If this is present then you can decrease the debug logging of the OpenSSH session by removing the -v option from the command line:

      ssh -N -n -L 10.255.255.1:44445:beuk.nikhef.nl:445 <Your-nikhef-userid>@login2.nikhef.nl
    

    Note If you carefully inspect the above screenshot then you will notice that I am using the (built-in) OpenSSH Authentication Agent in combination with an SSH public/private keypair to avoid having to type in my Nikhef password every time.

  • You will be prompted to authenticate yourself:

    For the Username, fill in the domain NIKHEF\ followed by your Nikhef-Windows userid.
    For the Password, fill in your Nikhef-Windows password, which might be different from the password you use to log in on login2.nikhef.nl and press OK.
  • You should now see your Nikhef home directory in Windows Explorer!

Congratulations!

Mapping a network drive

To make life even easier it might be handy to map a network drive to your Nikhef home directory:

  • Start Windows Explorer and choose Tools->Map Network Drive.
  • In the next screen, fill in:
    • Choose an available drive letter.
    • Do NOT click on Browse but type in as the Folder name: \\10.255.255.1\user\<Your-nikhef-userid>
    • Enable the checkbox in front of Connect using different credentials.
    • Now click on Finish.
  • In the next screen, fill in your Nikhef-Windows userid:

    For the User name, fill in the domain NIKHEF\ followed by your Nikhef-Windows userid.
    For the Password, fill in your Nikhef-Windows password, which might be different from the password you use to log in on login.nikhef.nl and press OK.
  • In the next screen, click on Finish to complete the network drive mapping.
  • You should now see a new drive letter appear in the Folders tree-list in Windows Explorer. Click on it to verify that you are indeed viewing your Nikhef home directory.

7. Control+Z! Undo! Undo!

For those wishing to undo the CIFS-over-SSH trick follow these steps:

  1. Start a console window with elevated (Administrator) privileges.
  2. Restore the automatic startup of the lanmanserver driver by typing
      sc config lanmanserver start= auto
    

    NOTE the space after the start= !

  3. Remove the portproxy rule by typing
      netsh interface portproxy delete v4tov4 listenaddress=10.255.255.1 listenport=445
    
  4. Remove the firewall rule to allow SSH to do portforwarding from 10.255.255.1:
    • Go to the Windows Control Panel
    • Select System and Security, then Windows Defender Firewall
    • Select Allowed apps, and scroll down in the list to SSH, Telnet and Rlogin client and deselect the permissions

      Then press OK
  5. Start a Device Manager by typing
      devmgmt.msc
    

    Expand the 'Network Adapters', right-click on Loopback adapter and select Uninstall.

  6. If necessary, use the 'Task Scheduler' from the 'Administrative Tasks' menu to delete the task 'Start LanmanServer driver'

That's all, folks!reprint:https://www.nikhef.nl/~janjust/CifsOverSSH/Win10Loopback.html#Install


Comments to Jan Just Keijser | lastmod = 26/01/2021 14:42

 

校园网跨网段共享文件Samba+SSH的更多相关文章

  1. 极路由设置共享磁盘密码、跨网访问samba服务

    极路由插上移动硬盘后会自动建立samba服务器,但我们没法去配置哪些盘符需要密码,这样只要在同一个wifi下的电脑都能去访问这些东西了,比较弱智.另外我还想再公司中去读写这个移动硬盘. 设置密码 首先 ...

  2. SQL Server 跨网段(跨机房)FTP复制

    一.本文所涉及的内容(Contents) 本文所涉及的内容(Contents) 背景(Contexts) 搭建过程(Process) 注意事项(Attention) 参考文献(References) ...

  3. SQL Server 跨网段(跨机房)复制

    一.本文所涉及的内容(Contents) 本文所涉及的内容(Contents) 背景(Contexts) 解决方案(Solution) 搭建过程(Process) 注意事项(Attention) 参考 ...

  4. hadooop 配置多网卡 提供跨网段服务

    http://hortonworks.com/blog/multihoming-on-hadoop-yarn-clusters/ https://hadoop.apache.org/docs/r2.6 ...

  5. elasticsearch 跨网段组集群

    elasticsearch 是非常流行的全文搜索引擎,但网上的教程多是初次使用,并没有一些高级用法demo.这次遇到需要跨网段组网问题,自己摸索了文档很久,发现确实可行,于是着手做了个实验,最终实验成 ...

  6. 如何使用UDP进行跨网段广播

    广播域首先我们来了解一下广播域的概念.广播域是网络中能接收任一台主机发出的广播帧的所有主机集合.也就是说,如果广播域内的其中一台主机发出一个广播帧,同一广播域内所有的其它主机都可以收到该广播帧.广播域 ...

  7. SQL Server跨网段(跨机房)FTP复制

    SQL Server跨网段(跨机房)FTP复制 2013-09-24 17:53 by 听风吹雨, 273 阅读, 0 评论, 收藏, 编辑 一. 背景 搭建SQL Server复制的时候,如果网络环 ...

  8. 如何使用UDP进行跨网段广播(转)

    源:http://blog.chinaunix.net/uid-22670933-id-3716646.html 广播域首先我们来了解一下广播域的概念.广播域是网络中能接收任一台主机发出的广播帧的所有 ...

  9. 如何使用UDP进行跨网段广播(转)

    源:如何使用UDP进行跨网段广播 广播域首先我们来了解一下广播域的概念.广播域是网络中能接收任一台主机发出的广播帧的所有主机集合.也就是说,如果广播域内的其中一台主机发出一个广播帧,同一广播域内所有的 ...

随机推荐

  1. NLog自定义Target之MQTT

    NLog是.Net中最流行的日志记录开源项目(之一),它灵活.免费.开源 官方支持文件.网络(Tcp.Udp).数据库.控制台等输出 社区支持Elastic.Seq等日志平台输出 实时日志需求 在工业 ...

  2. centos 7安装gitlab及使用

    GitLab 概述: 是一个利用 Ruby on Rails 开发的开源应用程序,实现一个自托管的 Git 项目仓库,可通过 Web界面迚行访问公开的戒者私人项目.Ruby on Rails 是一个可 ...

  3. NC14326 Rails

    NC14326 Rails 题目 题目描述 There is a famous railway station in PopPush City. Country there is incredibly ...

  4. NC20439 [SHOI2017]期末考试

    NC20439 [SHOI2017]期末考试 题目 题目描述 有 \(n\) 位同学,每位同学都参加了全部的 \(m\) 门课程的期末考试,都在焦急的等待成绩的公布.第 \(i\) 位同学希望在第 \ ...

  5. Tapdata 在线研讨会:如何快速上手 Tapdata Cloud?

    偶然接触到 Tapdata Cloud,据说不仅可以实现异构数据实时同步,还永久 100% 免费,但就是不知道怎么获取.怎么用? 打开相关文档逐渐陷入迷茫,术语."黑话"随处可见, ...

  6. java的Test 如何使用@Autowired注解

    1.配置来至bean.xml @RunWith(SpringJUnit4ClassRunner.class) @ContextConfiguration(locations = "class ...

  7. C++系统函数

    C++语言预先编写了很多常用函数提供给广大程序员使用,这些函数被统称为系统函数.C++语言全盘继承了C语言的标准C库,另外又增加了一些新的库(更多的是系统类库),这些新库被统称为C++标准库. 一.C ...

  8. day02 Java_变量

    参考: 变量的练习: 声明一个变量,一次声明多个变量. 声明变量直接初始化,先声明变量,而后再给变量初始化. 声明整型变量g,声明另一个整型变量h并赋值为h+10,输出变量h的值. 声明整型变量i,在 ...

  9. 多重分派(multiple dispatch)与访问者模式

    什么是双重分派 什么是分派(dispatch) 首先我们需要理解「分派」的含义.分派就是将方法调用与对应的具体方法绑定起来.而判断的依据有两点,这两者可称为「宗量」: 方法的接收者,也就是哪个对象调用 ...

  10. 【每天学一点-03】 使用Html5+Less实现简单的静态登录界面(入门Less)

    1.首先引用Less 有npm安装.cdn引用.或者下载Less.js本地引用,我采用的是第三种方法 less.js引用: 下载地址:https://github.com/less/less.js/t ...