SMB over SSH port forward

Question

I know that since SMB is not secure, opening port 445 on firewall makes your computer vulnerable. To secure my connection, I want to run a SMB mobile app via SSH. Would I still need to open port 445 on my router to enable SMB? Would my host computer be protected by running SMB over SSH?

Solution

Here is a simpler solution which is suitable if local filesystem sharing is not necessary:

1. https://superuser.com/a/1001889/507477
2. configure SSH access over internet to a server/router which has network access to the necessary SMB server.
3. When connecting to the SSH server, define port forwarding from local port 445 to the SMB server IP, port 445.
4. access the SMB server share via \\localhost

If local file sharing is necessary, a more difficult but achievable way is described here - http://www.nikhef.nl/~janjust/CifsOverSSH/Win8Loopback.html

Comments

[MariusMatutiae]

Not exactly the answer to your question, but did you consider sshfs? It exists for Android, play.google.com/store/apps/…

[Edgar Klerks]

I am not sure if I understood the question. But: No, you make connection to your host computer via SSH. Forward the port over a tunnel to your device. And connect locally on your device to port 445. So only port 22 is needed.

[Zoredache]

SSH is not a good choice for this. Get yourself a real VPN tool that gives a full IP link.

[Mike Scott]

It's not opening port 445 on your firewall that makes your computer vulnerable; it's running an SMB server. Blocking port 445 on your firewall mitigates that vulnerability, but it doesn't eliminate it entirely.

[pangyuteng]

thanks! ssh with port foward to samba host sudo ssh -L 445:127.0.0.1:445 user@sambahost -v, and then access samba host via smb://localhost/