A similar problem
Another possible lead
I had the same problem using ~/.ssh/authorized_keys
with permitopen
.
As I use autossh
to create a tunnel, I need two ports:
- one for connection (10000),
- one for monitoring (10001).
On client side
This gave me a similar problem with monitoring port:
autossh -M 10001 -o GatewayPorts=yes -o ServerAliveInterval=60 -o TCPKeepAlive=yes -T -N -R :10000:localhost:22 -i ~/.ssh/id_rsa user@remote
I had that message (after 10 minutes):
channel 2: open failed: administratively prohibited: open failed
On remote side
My /var/log/auth.log
contained:
Received request to connect to host 127.0.0.1 port 10001, but the request was denied.
In my ~/.ssh/authorized_keys
(remote side) I had this:
command="/home/user/tunnel",no-X11-forwarding,no-pty,permitopen="localhost:10000",permitopen="localhost:10001" ssh-rsa AAAA...
How to solve it
I solved this by replacing localhost
instances with 127.0.0.1
:
command="/home/user/tunnel",no-X11-forwarding,no-pty,permitopen="127.0.0.1:10000",permitopen="127.0.0.1:10001" ssh-rsa AAAA...
It seems that SSH does not understand that localhost
is a shortcut to 127.0.0.1
, hence the message in auth.log
and the administratively prohibited message.
What I understand here is that administratively means "due to a specific configuration on server side".
remote
" in my case.amazonaws
in the command which is equivalent to the DNS resolution failure note above.