How do I SSH into my Samba file server?

Question

So I made a dedicated Samba file server on my Debian(3.2) machine. I have had great success accessing it from both Windows and Unix. I can SSH into it on the local network.

When I try to SSH into it via the public IP address, it says connection refused.

I would like to be able to ssh into it remotely, directing into the Samba share. How would I go about doing this? I hear I might have to port forward? Do I need to change anything in the smb.conf file?

Here's my sshd_config file:

# Package generated configuration file
# See the sshd_config(5) manpage for details

# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 768

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 120
PermitRootLogin yes
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile %h/.ssh/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no

#MaxStartups 10:30:60
#Banner /etc/issue.net

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes

Answer 1

Scriptonaut, probably your problem has nothing to do with Samba, but has to do with port forwarding/NAT. If you have your SAMBA serving Debian computer in a LAN network, behind a router, you need it configured to transfer requests to some of its ports to your SAMBA running machine:

First, I'll tell, how outgoing connections work with router. When 2 machines speak via TCP/IP each machine (source machine and destination machine) is addressed with a pair IP/port number, so the connection is determined by 2 pairs: source IP/port number and destination IP/port number.

When you open a tab in Mozilla and access Google on your 192.168.1.2 machine, it transfers some IP packets to the Router with source address of itself IP=192.168.1.2 and arbitrary outgoing TCP port number it allocated for that tab of browser (like 43694) and asks the router to transfer that packets to Google machine with certain IP on 80 port of that machine, cause 80 is standard port for incoming http connections (you can see the list of standard TCP ports in /etc/services file on Linux). Router allocates a port of its own at random (e.g.12345), replaces source IP/port pair in that packets with its own WAN IP (74.25.14.86) and port 12345 and remembers, that if it gets response on port 12345 from Google, it should automatically transfer that response back to 192.168.1.2, port 43694.

Now, what happens when an outer machine wants to access your server?

When you try to access your SAMBA server from the outer machine, it sends IP packets to your WAN IP=74.25.14.86, port 22 of it (because, 22 is a standard TCP port for listening to SSH connections, you can see the list of standard TCP ports in /etc/services file on Linux). Your Router receives that packets. By default, firewalls on routers are configured to block all incoming connections to any port, if there was no outgoing connection, bound to that port (so, when you were accessing Google in previous case, router didn't block response from Google to port 12345 of itself, cause it remembered that your 192.168.1.2 initiated connection to Google and response from google should come to port 12345). But it would block attempts to initiate connections from the outer world to port 22 of it, cause port 22 was not mapped for any connections incoming from LAN.

So, what you need to do is to configure your router to transfer all the connections to its port 22 from the outside to port 22 of your 192.168.1.2. This can be done in web-interfaces of hardware routers, usually the menu option you need is called "Port-forwarding" or "NAT - network address translation".