Remote SSH Tunnel not working with certificates

Question

I need reverse port forwarding via SSH to my server, such that on the server I can connect to a localhost port, which then is forwarded using the SSH tunnel to my local server.

My local system is windows, remote system Linux. When opening the tunnel using plink with standard password authentication, it works pretty good:

>plink.exe -R *:62050:127.0.0.1:9000 [email protected]

Result on remote machine looks good and forwarding also works fine.

[user@host ~]$ netstat -an | grep 62050
tcp        0      0 127.0.0.1:62050             0.0.0.0:*                   LISTEN
tcp        0      0 ::1:62050                   :::*                        LISTEN

I however want to use that as a pre-debug command in my IDE to establish the tunnel, so I want to use my private key:

>plink.exe -R *:62050:127.0.0.1:9000 [email protected] -i C:\Users\abcdefg\.ssh\id_my.ppk

Connection also works great, I am not asked for a password and connection succeeds. However, there is no port opened:

[user@host ~]$ netstat -an | grep 62050

just returns an empty result. I can make the same observations when using the putty graphical interface. Remote tunnelling works like a charm using plain password auth, as soon as I am introducing a private key file, the connection is established, but the reverse tunnel is not.

How can I solve this?

Answer 1

The -v option will gives you more information on the client side.

plink.exe -v -R *:62050:127.0.0.1:9000 user@host -i ./np.ppk
Looking up host "host"
Connecting to 135.x.x.x port 22
Server version: SSH-2.0-OpenSSH_5.1
Using SSH protocol version 2
We claim version: SSH-2.0-PuTTY_Release_0.63
...
Opened main channel
Requesting remote port *:62050 forward to 127.0.0.1:9000
Remote port forwarding from *:62050 enabled              <---<<<
Allocated pty (ospeed 38400bps, ispeed 38400bps)
Started a shell/command
...

If you didn't manage to find the answer with plink verbose mode. Open sshd in debug mode on another port (or ask the root administrator to do that).
No need to stop the regular sshd deamon.

# /usr/sbin/sshd -dd -p  2222
debug2: load_server_config: filename /opt/ssh/etc/sshd_config
debug2: load_server_config: done config len = 514
debug2: parse_server_config: config /opt/ssh/etc/sshd_config len 514
debug1: Config token is port
debug1: Config token is protocol
debug1: Config token is hostkey
debug1: Config token is hostkey
....

Then connect to that sshd instance with plink option -P

plink.exe -v -P 2222 -R *:62050:127.0.0.1:9000 user@host -i ./np.ppk

You will have the debug information of both end.

EDIT

The solution is in man sshd at the "AUTHORIZED_KEYS FILE FORMAT" chapter.

It is likely that the no-port-forwarding option has been associated to your key but that no global option has been set.

 no-port-forwarding
         Forbids TCP forwarding when this key is used for authentication.  Any port forward requests by the client will return
         an error.  This might be used, e.g. in connection with the command option.

You should have access to your home ~/.ssh/authorized_keys , edit the file and remove that option.

Sometimes the authorized_keys are centralized in a protected directory in that case you will not be able to change it.