tinyapps.org / docs / AFP over SSH; or, How to Securely Access Your Mac's Files over the Internet without a VPN

NOTE: This guide is based on OS X 10.4.3.

I. Setup SSH Server:

  1. Forward port 22 on router to SSH server
  2. System Preferences > Sharing > Services > Check "Personal File Sharing" (to enable AFP) and "Remote Login" (to start OpenSSH service).

II. Connect from SSH Client:

  1. Open a Terminal window and type: sudo ssh ip_address -l username -L 22:127.0.0.1:548
    where ip_address is the public IP address or domain name of the SSH server and username is a valid OS X user account on the Mac running SSH server.
  2. Enter your local admin password when prompted and press Return.
  3. The first time you connect to a host, you will see a message about the "RSA key fingerprint". Type "yes" and press Return. (See this article for more information.)
  4. Enter the password corresponding to the username you entered in step 1 and press Return.
  5. You are now connected to the SSH server and can work from the command line. If you prefer a GUI:
  6. Minimize (do not close) the Terminal window.
  7. In the Finder, click Go > Connect to Server...
  8. Under "Server Address:" type: afp://127.0.0.1:22 and click Connect.
  9. Enter a username and password which exists on the SSH server (for example, the same one you used in step 1) and click "Connect".
  10. Choose the volume you wish to mount and click OK. The volume is mounted and a Finder window with its contents will open.
  11. When you are finished, unmount the share from your desktop and type "exit" in the minimized Terminal window to close the SSH connection.

III. Additional Security Considerations

Considering this recent analysis of malicious SSH login attempts, you may wish to harden SSH a bit. For detailed instructions, see sections 1 and 2 of: Hardening SSH and Mounting Remote Filesystem in OS X Finder via SSHFS.

created: 2006.09.27