14

On creating a VNC connection via tunneled SSH connection, I get an error:

channel 3: open failed: administratively prohibited: open failed

I have found that this happens only when I'm not logged into the host locally as the username on the host I'm trying to connect to using a tunneled VNC connection. SSH Tunnel:

ssh -p 6000 -L 5901:127.0.0.1:5901 [email protected]

VNC connection:

vncviewer localhost:1

I've tried adjusting the settings in /etc/ssh/sshd_config using AllowTunnel yes and without the setting. (I did restart ssh after each change: service ssh restart) However, the error goes away if I have a local session running on the remote host (i.e. I'm logged in as username locally.) Is anyone else seeing this behavior? It seems like I should be able to start a VNC remotely and access it with out having to logged in locally as well.

Improve this question
1
  • 1
    Mike, please check the tour to see how does this site work and if my answer solved your problem, please accept it.
    – Jakuje
    Commented May 11, 2016 at 21:01

2 Answers 2

Reset to default
20

The option you are looking for is not AllowTunnel (it is for VPN and level 3 forwarding using tun devices). You are looking for AllowTcpForwarding, which handles local and remote port forwarding of TCP traffic in ssh.

Have a look what values is in your server and change it to yes:

AllowTcpForwarding yes
Improve this answer
5
  • Thanks for your quick answer. That seems to have fixed my issue. I had seen others with the same issue and one suggestion was AllowTunnel yes in sshd_config, but that did not work for me.
    – Mike Swartz
    Commented Dec 6, 2015 at 21:45
  • 1
    It is probably some urban legend, as also the other answer came here. No idea where did it come from and it is so easy to open manual page and check the meaning. If it works for you, have a second to check the answer as solution to help others.
    – Jakuje
    Commented Dec 6, 2015 at 21:48
  • 1
    Why the down-vote?
    – Jakuje
    Commented Nov 7, 2016 at 22:04
  • AllowTcpForwarding Specifies whether TCP forwarding is permitted. The available options are “yes” or “all” to allow TCP forwarding, “no” to prevent all TCP forwarding, “local” to allow local (from the perspective of ssh(1)) forwarding only or “remote” to allow remote forwarding only. The default is “yes”.
    – Bart Polot
    Commented Dec 31, 2017 at 20:06
  • related (false): serverfault.com/a/24389/328011
    – YSC
    Commented Aug 27, 2019 at 11:44
0

I had a name resolution cause for this error. My /etc/hosts had an erroneous IP address for the name of the server (not for localhost), like this:

127.0.0.1     localhost
192.168.2.45  server.domain.com server

But the configured server IP (and the DNS name resolved with the host/dig commands) was 192.168.2.47. A simple typo caused by a previous IP reconfiguration. After fixing /etc/hosts the tunnel connection worked flawlessly:

ssh [email protected] -L 3456:127.0.0.1:5901

It is weird that the real IP caused the failure when I was using the localhost literal IP for the tunnel. Distro: Ubuntu 16.04 LTS.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .