Accessing iTunes libraries over the Internet

As a user of iTunes, I really enjoy being able to share the library on my Mini with my other devices. However, Apple doesn’t provide a method of doing this across the Internet.

Because iTunes uses mDNS (Bonjour) to broadcast its services, we need to be able to send those broadcasts over a VPN. Most VPN technologies don’t broadcast mDNS packets, though. OpenVPN can pass multicast packets between networks, but I really dislike installing more software on my computers. That leads to more vulnerabilities, and we can do just as good of a job using SSH.

When I’m out of the house, I always connect back to my home machines with SSH. Local port forwarding is invaluable to me for accessing internal-only services—it’s way more secure than opening those ports on my router. We can use the same method to access our iTunes library.

There are many articles online about sharing iTunes libraries over SSH, but if you look in the comments, they’re filled with users complaining that it no longer works.

A lot of these articles were from around 2008, so I can only assume that they’re parroting some source and those comments have been unresponded to because nobody actually knows what’s in an mDNS record.

So, let’s take a look at one. There’s an ultra-handy tool called dns-sd available with all Macs since 10.4. It’s a testing tool used to inspect mDNS things. We’re going to first use it to look at the service available on the iTunes host computer.

But first, it’s a good idea to understand how iTunes shares its music across a network. Long ago when iTunes first got the library sharing feature, it did so using the digital audio access protocol (DAAP). This is basically an HTTP server that sends lists and songs between computers. This is enabled in iTunes from Preferences > Sharing > Share my library on my local network.

Later, iTunes introduced Home Sharing, which uses an Apple ID to connect. I’m not sure what kind of protocol Home Sharing uses. To be honest, DAAP still works well so I don’t care that much. This is enabled in iTunes from File > Home Sharing > Turn On Home Sharing.

Anyway, DAAP works well, so let’s move forwards with that. The first thing we want to do is figure out what services are running. The available service types are available here. There, we can see the name for DAAP is (expectedly) daap. Therefore, let’s do a dns-sd -B (browse) for the available services on our iTunes host.

davisr:~> dns-sd -Z _daap .
Browsing for _daap._tcp
DATE: ---Wed 16 Dec 2015---
16:56:31.566  ...STARTING...

; To direct clients to browse a different domain, substitute that domain in place of '@'
lb._dns-sd._udp                                 PTR     @

; In the list of services below, the SRV records will typically reference dot-local Multicast DNS names.
; When transferring this zone file data to your unicast DNS server, you'll need to replace those dot-local
; names with the correct fully-qualified (unicast) domain name of the target host offering the service.

_daap._tcp                                      PTR     Davis'\032Mac\032Mini._daap._tcp
Davis'\032Mac\032Mini._daap._tcp                SRV     0 0 3689 aurora.local. ; Replace with unicast FQDN of target host
Davis'\032Mac\032Mini._daap._tcp                TXT     "txtvers=1" "Version=196621" "MID=0x3013BB0577A80F8C" "Database ID=B83900A26A9AB5BF" "Machine ID=ECD62DDDECE0" "dmv=131085" "OSsi=0x1F5" "Media Kinds Shared=3146791" "iTSh Version=196620" "Password=0" "Machine Name=Davis' Mac Mini"
^C

That’s the record we want to use. From this record, we can see a lot of good bits: it uses port 3689, this library’s name is “Davis' Mac Mini”, and really importantly, it gives us a TXT record.

To set up our tunnel, I’m going to be issuing the following commands from my laptop, far way from home. The first thing I need to do is set up a local port forward of 3689.

ssh -L 3690:localhost:3689 home

The tunnel is now active, but iTunes on my laptop has now way of seeing the remote library, because mDNS is not broadcast over the tunnel. Using dns-sd again, I can set up a proxy broadcast with the same information we gathered earlier when we browsed.

dns-sd -P "Davis' Mac Mini" _daap._tcp local 3690 localhost 127.0.0.1 "txtvers=1 Version=196621 MID=0x3013BB0577A80F8C Database\ ID=B83900A26A9AB5BF Machine\ ID=ECD62DDDECE0 dmv=131085 OSsi=0x1F5 Media\ Kinds\ Shared=3146791 iTSh\ Version=196620 Password=0 Machine\ Name=Davis\'\ Mac\ Mini"

And that’s literally it. The reason the articles mentioned earlier no longer work is because they’re all missing the TXT record. I think nobody has fixed those articles yet because a lot of people see this stuff as intimidating. The truth is: the world is a lot less complex than you may believe. The hardest part is figuring out what exists in the first place.