A similar problem
Another possible lead
I had the same problem using
As I use
autossh to create a tunnel, I need two ports:
- one for connection (10000),
- one for monitoring (10001).
On client side
This gave me a similar problem with monitoring port:
autossh -M 10001 -o GatewayPorts=yes -o ServerAliveInterval=60 -o TCPKeepAlive=yes -T -N -R :10000:localhost:22 -i ~/.ssh/id_rsa user@remote
I had that message (after 10 minutes):
channel 2: open failed: administratively prohibited: open failed
On remote side
Received request to connect to host 127.0.0.1 port 10001, but the request was denied.
~/.ssh/authorized_keys (remote side) I had this:
command="/home/user/tunnel",no-X11-forwarding,no-pty,permitopen="localhost:10000",permitopen="localhost:10001" ssh-rsa AAAA...
How to solve it
I solved this by replacing
localhost instances with
command="/home/user/tunnel",no-X11-forwarding,no-pty,permitopen="127.0.0.1:10000",permitopen="127.0.0.1:10001" ssh-rsa AAAA...
It seems that SSH does not understand that
localhost is a shortcut to
127.0.0.1, hence the message in
auth.log and the administratively prohibited message.
What I understand here is that administratively means "due to a specific configuration on server side".