Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

In the example below what do the channel numbers correspond to? Which are on the server? Which are on the client?

  $ ssh -L1570:127.0.0.1:8899 root@thehost
    Password:
    Last login: Fri Aug  9 13:08:44 2013 from theclientip
    Sun Microsystems Inc.   SunOS 5.10      Generic January 2005
    You have new mail.
    # channel 2: open failed: administratively prohibited: open failed
    channel 3: open failed: administratively prohibited: open failed
    channel 2: open failed: administratively prohibited: open failed

The ssh client is running on Windows 7 and the server has a Tomcat server running on port 8899.

Tomcat is not listening on 127.0.0.1 on the remote machine so if I change the command to ssh -L1570:thehostpublicip:8899 root@thehost the port forward works. So I know that port forwarding seems to be working just fine on the server.

my sshd config file contains the following two lines:

# Port forwarding
AllowTcpForwarding yes

# If port forwarding is enabled, specify if the server can bind to INADDR_ANY.
# This allows the local port forwarding to work when connections are received
# from any remote host.
GatewayPorts yes

I'm trying to setup port forwarding for another process not Tomcat and I get the error messages similar to the stuff above so I'm trying to understand the meaning of the error messages.

share|improve this question
add comment

2 Answers

up vote 7 down vote accepted

From the SSH Protocol documentation, regarding channels:

All terminal sessions, forwarded connections, etc., are channels. Either side may open a channel. Multiple channels are multiplexed into a single connection.

Channels are identified by numbers at each end. The number referring to a channel may be different on each side. Requests to open a channel contain the sender's channel number. Any other channel related messages contain the recipient's channel number for the channel.

Channels are flow-controlled. No data may be sent to a channel until a message is received to indicate that window space is available.

Port forwarding

The command you have looks fine. Are you sure that the service you're trying to connect to is up and accepting connections? The channel errors would seem to indicate that it's not.

What are my active channels?

If you have an active ssh connection you can use the following key combination to get help:

Shift+~ followed by Shift+?

$ ~?
Supported escape sequences:
  ~.  - terminate connection (and any multiplexed sessions)
  ~B  - send a BREAK to the remote system
  ~C  - open a command line
  ~R  - Request rekey (SSH protocol 2 only)
  ~^Z - suspend ssh
  ~#  - list forwarded connections
  ~&  - background ssh (when waiting for connections to terminate)
  ~?  - this message
  ~~  - send the escape character by typing it twice
(Note that escapes are only recognized immediately after newline.)
debug2: channel 2: written 480 to efd 8

You can then use this key combination to get a list of the active channels:

Shift+~ followed by Shift+#

$ ~#
The following connections are open:
  #2 client-session (t4 r0 i0/0 o0/0 fd 6/7 cc -1)
debug2: channel 2: written 93 to efd 8
share|improve this answer
add comment

If tomcat is not listening on loopback (127.0.0.1) then a port forward to that will give the error message you've been receiving.

If I do an ssh, with a port forward to a non-listening port (eg: ssh -L1234:127.0.0.1:9999 10.0.0.1 - where no process on 10.0.0.1 is bound to port 9999 on 127.0.0.1) , I get the same error:

channel 2: open failed: administratively prohibited: open failed

You can find out what channel is being referred to by adding -vvv to your ssh

ssh -vvv -L1570:127.0.0.1:8899 root@thehost

What port is the "other process" listening on (and on what IP addresses), netstat -tulpn will confirm what ports and IPs processes on your servers are using, the -L will have to point to an address and port it is listening on.

share|improve this answer
    
I can't reproduce the above. Are you enabling ssh parameters in either the client and/or server to get this? –  slm Aug 9 '13 at 18:59
    
Nope (standard 'out of the box' configs on both sides). As far as I can work out you get connect failed: Connection refused when a firewall denies the connection. administratively prohibited: open failed is on a host without a firewall. –  Drav Sloan Aug 9 '13 at 19:41
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.