Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I need reverse port forwarding via SSH to my server, such that on the server I can connect to a localhost port, which then is forwarded using the SSH tunnel to my local server.

My local system is windows, remote system Linux. When opening the tunnel using plink with standard password authentication, it works pretty good:

>plink.exe -R *:62050:127.0.0.1:9000 username@host.com

Result on remote machine looks good and forwarding also works fine.

[user@host ~]$ netstat -an | grep 62050
tcp        0      0 127.0.0.1:62050             0.0.0.0:*                   LISTEN
tcp        0      0 ::1:62050                   :::*                        LISTEN

I however want to use that as a pre-debug command in my IDE to establish the tunnel, so I want to use my private key:

>plink.exe -R *:62050:127.0.0.1:9000 user@host.com -i C:\Users\abcdefg\.ssh\id_my.ppk

Connection also works great, I am not asked for a password and connection succeeds. However, there is no port opened:

[user@host ~]$ netstat -an | grep 62050

just returns an empty result. I can make the same observations when using the putty graphical interface. Remote tunnelling works like a charm using plain password auth, as soon as I am introducing a private key file, the connection is established, but the reverse tunnel is not.

How can I solve this?

share|improve this question
    
maybe it is just the parameters order, put user@host.com in the last position –  Emmanuel Feb 19 at 23:20
    
@Emmanuel: Thanks for your answer. I tried to put the user@server part at the end. The connection is successful, however, there still is no port opened at the remote server. –  waza-ari Feb 20 at 8:43
    
I was not able to reproduce, it worked in both case. Are you running the last putty version. chiark.greenend.org.uk/~sgtatham/putty/download.html –  Emmanuel Feb 20 at 16:26

1 Answer 1

up vote 1 down vote accepted

The -v option will gives you more information on the client side.

plink.exe -v -R *:62050:127.0.0.1:9000 user@host -i ./np.ppk
Looking up host "host"
Connecting to 135.x.x.x port 22
Server version: SSH-2.0-OpenSSH_5.1
Using SSH protocol version 2
We claim version: SSH-2.0-PuTTY_Release_0.63
...
Opened main channel
Requesting remote port *:62050 forward to 127.0.0.1:9000
Remote port forwarding from *:62050 enabled              <---<<<
Allocated pty (ospeed 38400bps, ispeed 38400bps)
Started a shell/command
...

If you didn't manage to find the answer with plink verbose mode. Open sshd in debug mode on another port (or ask the root administrator to do that).
No need to stop the regular sshd deamon.

# /usr/sbin/sshd -dd -p  2222
debug2: load_server_config: filename /opt/ssh/etc/sshd_config
debug2: load_server_config: done config len = 514
debug2: parse_server_config: config /opt/ssh/etc/sshd_config len 514
debug1: Config token is port
debug1: Config token is protocol
debug1: Config token is hostkey
debug1: Config token is hostkey
....

Then connect to that sshd instance with plink option -P

plink.exe -v -P 2222 -R *:62050:127.0.0.1:9000 user@host -i ./np.ppk

You will have the debug information of both end.

EDIT

The solution is in man sshd at the "AUTHORIZED_KEYS FILE FORMAT" chapter.

It is likely that the no-port-forwarding option has been associated to your key but that no global option has been set.

 no-port-forwarding
         Forbids TCP forwarding when this key is used for authentication.  Any port forward requests by the client will return
         an error.  This might be used, e.g. in connection with the command option.

You should have access to your home ~/.ssh/authorized_keys , edit the file and remove that option.

Sometimes the authorized_keys are centralized in a protected directory in that case you will not be able to change it.

share|improve this answer
    
thanks for your detailed explanation. -v using the key results in the message: "Remote debug message: Server has disabled port forwarding.", and the port forwarding is refused. However, the same server, without private key results in "Remote port forwarding from *:62050 enabled.". So what can cause the forwarding to be refused with key? –  waza-ari Feb 20 at 20:23
    
@waza-ari just made an update –  Emmanuel Feb 21 at 18:54
    
Thank you very much! I forgot an old gitlab installation on that server, which required the no-port-forwarding option for the ssh keys. Removed that old stuff from config and it finally worked. Unfortunately I cannot upvote yet. –  waza-ari Feb 22 at 8:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.