I'm setting up
syncthing on my qnap nas, and currently at the point where I want to forward the nas' GUI to my laptop, which is on the same network. The GUI is available on the nas on port
[~] # nc -zv 127.0.0.1 8384 localhost [127.0.0.1] 8384 (?) open
Now, to access this service from the laptop, I use
ssh -p 50022 -L 9090:127.0.0.1:8384 admin@nasipaddress -v
, as described here (
-v added for debugging). Doing this, and then accessing 127.0.0.1:9090 on my laptop's browser, gives me the following error in the terminal (terminal into the nas that was opened by the
ssh command above):
[~] # debug1: Connection to port 9090 forwarding to 127.0.0.1 port 8384 requested. debug1: channel 3: new [direct-tcpip] channel 3: open failed: administratively prohibited: open failed debug1: channel 3: free: direct-tcpip: listening port 9090 for 127.0.0.1 port 8384, connect from 127.0.0.1 port 36462 to 127.0.0.1 port 9090, nchannels 4
This message is repeated 10 times, each time incrementing the port
administratively prohibited seems to imply that it's some setting, I'd guess on the nas itself, and I'll look into that. I'm also unsure where the port (
36462) being used is coming from, though.
Protocol 2 HostKey /etc/ssh/ssh_host_rsa_key HostKey /etc/ssh/ssh_host_dsa_key PermitRootLogin yes UseDNS no Subsystem sftp /usr/libexec/sftp-server AllowTcpForwarding yes AllowUsers admin PermitTunnel yes
I have restarted the ssh daemon after changing the config.
I'm using authorised keys, and all lines in
.ssh/authorized_keys consist of
ssh-rsa l0ngcrpt0grAph1cK3Y descriptive name
edit: I've rewritten the question to reflect new information.
Turns out, changes to
sshd_config on the qnap nas are undone when restarting the ssh daemon. Yeah, I know. So the only way to make sure the line
AllowTcpForwarding yes survives, is by adding it another way, like so:
setcfg LOGIN "SSH AllowTcpForwarding" TRUE
This does survive a restart of sshd and a reboot of the system.