266

When I open this ssh tunnel:

ssh -nXNT -p 22 localhost -L 0.0.0.0:8984:remote:8983

I get this error when trying to access the HTTP server running on localhost:8984:

channel 1: open failed: administratively prohibited: open failed

What does this error mean, and on which machine can you fix the problem?

9
  • 1
    Maybe I'm missing something, but why are you trying to access a web server using a ssh client? Jun 1, 2011 at 17:00
  • Why are you forwarding X11 (-X option) here? If you want to only forward HTTP this is not necessary. And as a side note IMHO ssh might be the wrong solution to make a Webserver available on multiple ports.
    – Marcel G
    Jun 3, 2011 at 9:16
  • 45
    I found this to mean "Cannot resolve hostname remote" in my case.
    – RobM
    Apr 22, 2013 at 16:56
  • 5
    As you can see from the dozen of answers below, the error message, despite looking very specific, should be understood as a generic error. Generally, the solution is to open a shell at the remote and try the very same connection, to see the actual cause. You will find in answers below the most common actual causes. Jan 31, 2015 at 7:49
  • 1
    A slight addition to one of the comments above: "A DNS resolution failure may cause this error" -- also make sure you're spelling your hostname correctly. I just spent over an hour trying to debug all the ssh settings and it turns out I had just misspelled amazonaws in the command which is equivalent to the DNS resolution failure note above.
    – Brad Dwyer
    Apr 16, 2018 at 15:04

28 Answers 28

188

channel 1: open failed: administratively prohibited: open failed

The above message refers to your SSH server rejecting your SSH client's request to open a side channel. This typically comes from -D, -L or -w, as separate channels in the SSH stream are required to ferry the forwarded data across.

Since you are using -L (also applicable to -D), there are two options in question that are causing your SSH server to reject this request:

  • AllowTcpForwarding (as Steve Buzonas mentioned)
  • PermitOpen

These options can be found in /etc/ssh/sshd_config. You should ensure that:

  • AllowTCPForwarding is either not present, is commented out, or is set to yes
  • PermitOpen is either not present, is commented out, or is set to any [1]

Additionally, if you are using an SSH key to connect, you should check that the entry corresponding to your SSH key in ~/.ssh/authorized_keys does not have no-port-forwarding or permitopen statements [2].

Not relevant to your particular command, but somewhat relevant to this topic as well, is the PermitTunnel option if you're attempting to use the -w option.


17
  • 1
    Here what I specifically add in sshd_config to make it work: TCPKeepAlive yes AllowTCPForwarding yes PermitOpen any I have a few "open failed" but it seems a normal thing. Things work very well. Jan 17, 2015 at 6:58
  • 7
    A corner case to note: You can get this error when trying to create a tap/tun device with SSH and SSH allows it, but the kernel does not. This can occur in LXC containers. See blog.felixbrucker.com/2015/10/01/… for the exact details, but in that case you may want to add lxc.cgroup.devices.allow = c 10:200 rwm to your container's config, and ensure that if /dev/net/tun does not exist, mknod /dev/net/tun c 10 200; chmod 666 /dev/net/tun is run on bootup in the container.
    – Azendale
    Apr 16, 2016 at 0:58
  • 1
    For some reason I had to enable both options in the sshd_config for this to work.
    – erikbstack
    May 8, 2017 at 18:56
  • 1
    @St.Antario, AllowTcpForwarding allows you to forward TCP ports over SSH, which is what the -L 0.0.0.0:8984:remote:8983 parameter is requesting. If AllowTcpForwarding is set to no, SSH will reject the port forwarding request, causing you to see that error.
    – hyperair
    Nov 12, 2018 at 11:20
  • 2
    Tried to edit the upper-case of AllowTCPForwarding to AllowTcpForwarding, but SE wants at least 6 characters changed. So just noting that the correct case is the Tcp version, as used correctly the first time.
    – dbreaux
    Apr 12, 2019 at 19:56
73

In a very weird case, I also experienced this error while trying to create a local tunnel. My command was something like this:

ssh -L 1234:localhost:1234 user@remote

The problem was, on the remote host, /etc/hosts had no entry for "localhost" so the ssh server didn't know how to setup the tunnel. A very unfriendly error message for this case; glad I finally figured it out.

The lesson: make sure the target hostname of your tunnel is resolvable by the remote host, either via DNS or /etc/hosts.

5
  • 2
    Thanks, this was the issue for me. I created the host name for the IP locally but not on the remote ssh server.
    – dev_feed
    Apr 20, 2016 at 12:29
  • 3
    "the target hostname of your tunnel " is a bit hard to decipher. Can you give a concrete workable example that would allow me to take your example and replace the "target hostname" in your example with my target hostname (once I understand what you mean by that) and have this work? May 12, 2017 at 10:42
  • 2
    I'm not even sure your comment makes sense. You say that the remote machine had no entry for localhost. But then say that the remote host must resolve the target hostname not the local hostname. Again a complete concrete example of the situation before and after would be helpful. May 12, 2017 at 10:44
  • 2
    @TerrenceBrannon in the command above, "localhost" is the target hostname of the tunnel. When creating an SSH tunnel, the ssh command first logs into the remote system (user@remote), then from the remote end, it sets up tunnels to the target hosts listed (in the above command this is localhost). When doing this, it uses the hostname resolution scheme on the remote host. So if the machine you SSH'd into cannot resolve localhost, you'll get this error message.
    – cobbzilla
    Aug 16, 2017 at 5:30
  • 5
    In my case, it was as simple as having mistyped the target hostname, so of course it didn't resolve, but my eyes missed seeing the typo for far too long.
    – Randall
    Mar 24, 2018 at 19:19
29

At least one answer is that the machine "remote" is unreachable with ssh for some reason. The error message is just absurd.

4
  • 3
    No it isn't; I use icmp-admin-prohibited as the reject flag in firewall configs all the time.
    – Shadur
    Jun 1, 2011 at 19:29
  • 12
    +1, The administratively prohibited message would cause one to believe that it is a firewall blockage, however you receive the same message when there is no firewall blockage but the open fails because there is no route to the remote host. Jun 2, 2012 at 21:04
  • 1
    I have just spent several minutes hunting this problem, whose message doesn't make any sense in my context down. Thankfully it's pretty clear upon checking the middle station log files. Jun 10, 2013 at 20:46
  • Indeed if "remote" is unreachable - because it's down, offline, doesn't exist, hostname doesn't resolve - then you'll see this error message. Sep 8, 2015 at 22:39
21

If the 'remote' cannot be resolved on the server you will get that error. Replace with an IP address and see if that resolves your issue...

(Basically same answer as that of Neil - but I certainly found that to be the issue on my side) [I had an alias for the machine name in my ~/.ssh/config file - and the remote machine knew nothing of that alias...

1
  • You may also see the same error when using -D (DynamicForward) as a SOCKS proxy in a browser. I.e. trying to access a website that the tunnel host can not resolve.
    – timss
    Sep 2, 2016 at 9:05
13

This error definitively pops up when you use ssh options ControlPath and ControlMaster for sharing one socket connection to be reused between several client connections (from one client to the same user@server). Opening too many (whatever it means, in my case ~20 connections) yields this message. Closing any previous connections lets me open newer, again up to the limit.

4
  • I came here looking for where to set this ControlMaster multiplex limit. If anyone knows, they are more than welcome to share.
    – clacke
    Jul 17, 2013 at 0:55
  • 1
    clacke: according to bugs.debian.org/cgi-bin/bugreport.cgi?bug=546854 you can add a MaxSession parameter in /etc/ssh/sshd_config file to set this. According to man page, this is set to 10 by default.
    – oliver
    Oct 23, 2013 at 10:36
  • @oliver: confirming, MaxSession works, thanks. bumped to 64 on my workbook. Apr 3, 2014 at 8:58
  • 3
    Be careful, it's not MaxSession but MaxSessions. Although there are some protections, don't break your ssh server configuration... Jan 30, 2015 at 14:36
8

This also happens when /etc/sshd_config has

AllowTcpForwarding no 

set. Switch it to yes to allow TCP forwarding.

8

In my case, I had to replace localhost with 127.0.0.1 in:

ssh -L 1234:localhost:3389 user@remote

to make it work.

I was trying to rdesktop -L localhost:1234 following Amazon's instructions on connecting to AWS EC2 via SSH tunneling. I had tried to change /etc/ssh/sshd_config (both client and server run Ubuntu 16.04 LTS) per the highest voted answer. I also checked that localhost is in /etc/hosts on both sides.

Nothing worked until I changed the ssh command itself to:

ssh -L 1234:127.0.0.1:3389 user@remote
1
  • Same, and I wish I knew whyyyy!
    – NateS
    Mar 13, 2020 at 0:40
7

"administratively prohibited" is a specific ICMP message flag that boils down to "The administrator explicitly wants this connection blocked".

Check your iptables settings.

3
  • 8
    Not necessarily. The message is generated when the host cannot serve the request. The case is generally because the admin has blocked the connection, but it can also be that is it not explicitly blocked but there is no route to the desired host. AFAIK ssh has no logic to determine why a connection failed, it just assumes that if you are trying to connect, then it exists, and if you can't get there the connection must have been blocked intentionally. Jun 2, 2012 at 21:11
  • 3
    Uh, no. There is a distinct difference between the type of ICMP response that says "no route to host" and one that says "administratively prohibited", and unless someone deliberately misconfigured a router, the latter means exactly what it says on the tin.
    – Shadur
    Jan 3, 2014 at 23:07
  • 4
    I just got 'administratively prohibited' when using a hostname that didn't resolve, so it does seem to be a catch-all. Perhaps ssh is doing some translation? Sep 23, 2014 at 5:38
6

I'm extremely surprised that no one have mentioned that this might be a DNS issue.

journalctl -f
channel 3: open failed: administratively prohibited: open failed
Mar 10 15:24:57 hostname sshd[30303]: error: connect_to user@example.com: unknown host (Name or service not known)

This might be presented if remote is not resolvable or you've enter a unknown syntax like I've done here where I've added a user@ to the port-forward logic (which won't work).

1
  • I'm extremely happy that I saw this answer and realised I had a typo in my domain name..thanks. Saved me some time. Apr 28 at 20:36
5

A similar problem

Another possible lead

I had the same problem using ~/.ssh/authorized_keys with permitopen.

As I use autossh to create a tunnel, I need two ports:

  • one for connection (10000),
  • one for monitoring (10001).

On client side

This gave me a similar problem with monitoring port:

autossh -M 10001 -o GatewayPorts=yes -o ServerAliveInterval=60  -o TCPKeepAlive=yes -T -N -R :10000:localhost:22 -i ~/.ssh/id_rsa user@remote

I had that message (after 10 minutes):

channel 2: open failed: administratively prohibited: open failed

On remote side

My /var/log/auth.log contained:

Received request to connect to host 127.0.0.1 port 10001, but the request was denied.

In my ~/.ssh/authorized_keys (remote side) I had this:

command="/home/user/tunnel",no-X11-forwarding,no-pty,permitopen="localhost:10000",permitopen="localhost:10001" ssh-rsa AAAA...

How to solve it

I solved this by replacing localhost instances with 127.0.0.1:

command="/home/user/tunnel",no-X11-forwarding,no-pty,permitopen="127.0.0.1:10000",permitopen="127.0.0.1:10001" ssh-rsa AAAA...

It seems that SSH does not understand that localhost is a shortcut to 127.0.0.1, hence the message in auth.log and the administratively prohibited message.

What I understand here is that administratively means "due to a specific configuration on server side".

2
  • localhost likely mapped to ::1 (ipv6) and you weren't listening there for some reason
    – Jo Rhett
    Oct 23, 2017 at 22:29
  • This may actually have to do with the UseDNS no option in in sshd_config, although localhost should be listed in /etc/hosts and therefore conventionally doesn't require a full DNS lookup. Dec 14, 2021 at 20:56
4

This can also be caused by being unable to bind to the port on the local side.

ssh -Nn -L 1234:remote:5678 user@remote

This command is trying to bind a listening port 1234 on the local machine, which maps to a service on port 5678 on a remote machine.

If port 1234 on the local machine is already in use by another process, (maybe a background ssh -f session), then ssh will not be able to listen on that port and the tunnel will fail.

The problem is that this error message can mean any of several things, and "administratively prohibited" gives the wrong idea sometimes. So in addition to checking DNS, firewalls between local and remote, and sshd_config, check to see if the local port is already used. Use

lsof -ti:1234

to figure out what process is running on 1234. You might need sudo for lsof to list processes owned by other users. Then you can use

ps aux | grep <pid>

to find out what that process is.

To get this all in one command:

ps aux | grep "$(sudo lsof -ti:1234)"
1
  • 1
    That should cause bind [0.0.0.0]:<port>: Address already in use and shouldn't result into the OP's issue
    – Junaid
    Nov 15, 2021 at 21:38
3

Some troubleshooting activity is needed to find a definitive answer:

  • check that port forwarding is enabled in user's ssh configuration,
  • enable verbosity of ssh (-v),
  • check ssh logs on local host and secure logs on remote one,
  • test different remote port,
  • check your iptables settings (as Shadur said).
3

I got this error once for putting the remote in the -L parameter, also the 0.0.0.0 is redundant you can omit it with the same results, and I think you should add the -g for it to work.

This is the line I use for tunneling: ssh -L 8983:locahost:8984 user@remote -4 -g -N

-4 tells to use only ipv4
-g Allows remote hosts to connect to local forwarded ports.
-N Do not execute a remote command.  This is useful for just forwarding ports (protocol version 2 only). I use this to clog the terminal so I don't forget to close it since generally I need the tunnels temporarily.
3

In my case, the issue was due to requesting a tunnel without shell access while the server aimed to force a password change on my account. Due to the lack of a shell, I could not see that and only received the error

channel 2: open failed: administratively prohibited: open failed  

My tunnel configuration was as follows:

ssh -p [ssh-port] -N -f -L [local-port]:127.0.0.1:[remote-port]
[server-address]

The error showed when logging in directly to the server (without -N -f):

WARNING: Your password has expired. You must change your password now
and login again!

I resolved the issue by logging in with shell access and changing the password. Then I could simply use tunnels without shell access again.

2

I had the same message while trying to tunnel. There was a problem with the dns server on the remote side. The problem was solved when it came back to work.

2

I was getting the same message while SSH tunelling to Debian. It turned out the remote system had no free space. After freeing up some disk space and rebooting, the tunnel started working.

1

I had this problem when trying to connect via SSH with a user that was only authorized to connect using SFTP.

For example, this was in the server's /etc/ssh/sshd_config:

Match group sftponly
    ForceCommand internal-sftp
    ChrootDirectory /usr/chroot/%u
    [...]
Match

So in this case, to use SSH, you will have to either remove the user from the equivalent sftponly group or connect using a user that is not limited to SFTP.

1

Check if /etc/resolv.conf is empty on the server you're ssh-ing to. Several times I found this to be related to an empty /etc/resolv.conf file

If non root, you can just check on the server by trying some ping or telnet (80) on a public hostname, i.e.:

root@bananapi ~ # telnet www.google.com 80
telnet: could not resolve www.google.com/80: Name or service not known

After adding nameserver records to /etc/resolv.conf:

root@bananapi ~ # telnet www.google.com 80
Trying 74.125.195.104...
Connected to www.google.com.
Escape character is '^]'.
GET / HTTP/1.0

HTTP/1.0 302 Found
Location: http://www.google.ro/?gws_rd=cr&ei=8fStVZ-hMIv6UvX6iuAK

However, you should also check why /etc/resolv.conf was empty (this is usually populated with nameserver records by the dhcp client on the server, if applicable.

0

I saw this error on cygwin and this should be true of linux too and worked for me. In my case i'd done ssh -ND *:1234 user@127.0.0.1 and when I connected a browser to that comp-socks server , it browsed, but on the comp where I ran that ssh command I got that error appearing at the console with each request - for one site at least, though the browser retrieved it through the proxy or seemed to, at least to the extent that I saw the main age. But making this change got rid of the failed message

http://linuxindetails.wordpress.com/2010/02/18/channel-3-open-failed-administratively-prohibited-open-failed/

While trying to do some SSH tunneling, here is the error I got :
channel 3: open failed: administratively prohibited: open failed
To avoid this kind of error, have a look at the SSH daemon configuration file :
/etc/ssh/sshd_config
Add possibly the following line :
root@remote-server:~# echo “PermitTunnel yes” >> /etc/ssh/sshd_config
Then, restart your sshd server :
root@remote-server:~# service ssh restart
or

root@remote-server:~# /etc/init.d/ssh restart
4
  • AFAIK tunneling is enabled by default because disabling doesn't add any layer of security, primarily just an inconvenience of adding a 3rd party tunnel. I am having a similar problem trying to proxy to internal servers from an off site location and tunneling is enabled + iptables flushed with default action to ACCEPT. Jun 2, 2012 at 3:09
  • @SteveBuzonas I see this in /etc/sshd_config so a)it doesn't disable tunneling b)as regards my answer, the solution there may not be a good idea. Here is what sshd_config says about that option # To disable tunneled clear text passwords, change to no here! #PermitTunnel no
    – barlop
    Jun 2, 2012 at 8:05
  • @SteveBuzonas check your one it probably is set to no and you can tunnel as indeed tunneling is enabled by default.
    – barlop
    Jun 2, 2012 at 8:06
  • I was thinking of AllowTCPForwarding, The comment you are talking about # To disable tunneled clear text is in regards to PasswordAuthentication being set to no, PermitTunnel is a setting to allow layer 2 or layer 3 networking tunnels via tun/tap and defaults to no. The L, R, and D options use TCP forwarding and not a device for tunneling. Jun 2, 2012 at 21:00
0

Check your router for DNS Rebinding protection. My router (pfsense) has DNS Rebinding Protection Enabled by default. It was causing the 'channel open: failed administratively prohibited: open failed' error with SSH

0

I had the same issue and i realized that it was DNS. Traffic is tunneled but DNS request no. Try to edit you DNS hosts file manually and add the service you wish to access.

0

It seems there a lot of possible root causes for this message. In my case it was an inability to access the remote because I hadn't provided the keyfile correctly.

The -L option adds an implicit SSH jump (effectively using the explicit SSH host as a bastion/jump server). It may be easier to debug this by performing the jump explicitly and creating a login shell to the target machine using "proxycommand".

Once this is working, you can do the port forward based on the target machine's localhost (assuming it can log in to itself):

-N -L 1234:localhost:1234
0

The Asus RT68U router's firmware (Merlin Asus) has a setting that permits SSH port forwarding, which must be enabled:

enter image description here

Dynamic port forwarding was setup as described at: Dyamic tunnel troubleshooting

0

I just wanted to confirm what @hyperair mentioned in their answer. I was trying to do the following type of SSH connection using a ProxyJump.




┌─────────────────────┐     ┌─────────────────────┐      ┌─────────────────────┐
│                     │     │                     │      │                     │
│                     │     │                     │      │                     │
│     SSH Client      ├────►│  ProxyJump Server   ├─────►│      SSH Server     │
│                     │     │                     │      │                     │
│                     │     │                     │      │                     │
└─────────────────────┘     └─────────────────────┘      └─────────────────────┘



In my scenario I had the following in my client's SSH ~/.ssh/config.

StrictHostKeyChecking no
ControlPersist 10m
ServerAliveInterval 240
ForwardAgent yes
ForwardX11 yes

# adds keys found to ssh-agent
UseKeychain yes
AddKeysToAgent yes

Host host1-ext.mydom.com
    Hostname host1.dyndns.org
    Port 3022
    IdentityFile ~/.ssh/ssh_slm@mydom.com_id_rsa
    User slm
    ForwardAgent yes

Host host2-ext.mydom.com
    Hostname host2.mydom.lan
    IdentityFile ~/.ssh/ssh_slm@mydom.com_id_rsa
    User slm
    ProxyJump host1-ext.mydom.com

When using a ProxyJump configuration the server in between, host1.dyndns.org needed to have the configuration options enabled on its /etc/ssh/sshd_config file, mainly:

$ more /etc/ssh/sshd_config
...
TCPKeepAlive yes
AllowTcpForwarding yes
...

Without these settings I'd get the following error:

$ channel 0: open failed: administratively prohibited: open failed
stdio forwarding failed
kex_exchange_identification: Connection closed by remote host

But adding them and bouncing the SSHD on the "proxy" server (i.e. the one in the middle) enabled it so I could SSH all the way through.

0

Other name resolution cause: My /etc/hosts had an erroneous IP address for the name of the server (not for localhost), like this:

127.0.0.1     localhost
192.168.2.45  server.domain.com server

But the configured server IP (and the DNS name resolved with the host/dig commands) was 192.168.2.47. A simple typo caused by a previous IP reconfiguration. After fixing /etc/hosts the tunnel connection worked flawlessly:

ssh user@server.domain.com -L 3456:127.0.0.1:5901

It is weird that the real IP caused the failure when I was using the localhost literal IP for the tunnel. Distro: Ubuntu 16.04 LTS.

0

So many answers, and none covered my scenario, so I'll share as well.

I was getting this error message when using VNC over an SSH tunnel. The tunnel would be created just fine but then when I tried to open the VNC session, nothing would happen on the client and the tunnel would log a very similar "administratively prohibited" error.

The solution was to fix the max logins in /etc/security/limits.conf on the target machine. This was very confusing to me, since I had not yet authenticated with VNC so I don't know how it "knew" it was me.

(If it matters, my ssh client was actually plink from PuTTY.)

-1

My case:

$ssh -D 8081 localhost >>log1.txt 2>&1 &

----wait for 3 days

$tail -f log1.txt
channel 963: open failed: connect failed: Connection refused
channel 963: open failed: connect failed: Connection refused
channel 971: open failed: connect failed: Connection reset by peer
channel 982: open failed: connect failed: Connection timed out
channel 979: open failed: connect failed: Connection timed out
channel 1019: open failed: administratively prohibited: open failed
accept: Too many open files
channel 1019: open failed: administratively prohibited: open failed
accept: Too many open files
channel 1019: open failed: administratively prohibited: open failed

$ps  axu | grep 8081
root       404  0.0  0.0   4244   592 pts/1    S+   05:44   0:00 grep --color=auto 8081
root       807  0.3  0.6   8596  6192 ?        S    Mar17  76:44 ssh -D 8081 localhost

$lsof -p 807 | grep TCP
ssh     807 root 1013u  sock     0,8      0t0 2076902 protocol: TCP
ssh     807 root 1014u  sock     0,8      0t0 2078751 protocol: TCP
ssh     807 root 1015u  sock     0,8      0t0 2076894 protocol: TCP
.....

$lsof -p 807 | wc -l
1047

$ cat /etc/hosts
127.0.0.1   localhost
127.0.1.1   malcolm-desktop

$ssh localhost
Welcome to Ubuntu 14.04.2 LTS (GNU/Linux 3.13.0-53-generic i686)

----after restart ssh -D 8081 localhost
$ lsof -p 1184 | grep TCP
ssh     1184 root    3u  IPv4 2332193      0t0   TCP localhost:37742->localhost:ssh (ESTABLISHED)
ssh     1184 root    4u  IPv6 2332197      0t0   TCP ip6-localhost:tproxy (LISTEN)
ssh     1184 root    5u  IPv4 2332198      0t0   TCP localhost:tproxy (LISTEN)
ssh     1184 root    6u  IPv4 2332215      0t0   TCP localhost:tproxy->localhost:60136 (ESTABLISHED)
ssh     1184 root    7u  IPv4 2336142      0t0   TCP localhost:tproxy->localhost:32928 (CLOSE_WAIT)
ssh     1184 root    8u  IPv4 2336062      0t0   TCP localhost:tproxy->localhost:32880 (CLOSE_WAIT)
-1

Issue could be with the destination hostname, if using this form:

ssh -L 12345:destination:54321  tunnelhost

Make sure "destination" is resolvable from tunnelhost To fix my issue, I had to use the fully qualified domain name for the target.

ssh -L 12345:destination.domain.host:54321  tunnelhost

Not the answer you're looking for? Browse other questions tagged or ask your own question.