I would like to be able to establish an SSH connection to a remote server, through an IPSec tunnel. So I need to use the local endpoint as an intermediate hop to achieve this.

The following command already works fine:

ssh -tt smals ssh -tt lpextapp050a

  • smals is the name of the intermediate server, as defined in my .ssh/config file.
  • lpextapp050a is the name of the destination server, as defined in the .ssh/config file of smals

So I tried translating this into a configuration for my .ssh/config as follows:

Host lpextapp050a
User <username>
ProxyCommand ssh root@smals -W lpextapp050a:22

However, attempting to connect with ssh lpextapp050a gives me this error:

channel 0: open failed: administratively prohibited: open failed
stdio forwarding failed
ssh_exchange_identification: Connection closed by remote host

Google seemed to indicate I needed to check the AllowTcpForwarding and PermitOpen settings of the sshd on smals, but those are correctly set, ie. they are not present in the settings file. I tried specifically setting them, which did not change anything.

Does anyone have an idea what I'm doing wrong?

marked as duplicate by msp9011, jimmij, Thomas, Dani_l, Archemar Feb 5 at 8:57

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • I'm a bit ambivalent about the 'possible duplicate'... That question has no accepted answer and I tried the nr. 1 answer without success. It turns out that the nr. 2 answer was sort of relevant, but is not explained clearly enough for me to realize this before I found the solution myself... Answer nr. 7 did end up pointing me to the right logfile to read. – Falc Feb 4 at 13:55

I have discovered my error.

The lpextapp050a alias was defined in the .ssh/config file of the root user of the smals server.

When making the connection using ssh -tt smals ssh -tt lpextapp050a this config file was loaded and honored.

Trying to establish the same using the ProxyCommand did not load this config file. I finally managed to discover this by reading the /var/log/auth.log file on my smals server.

Thus, I solved my problem by basically copying over the relevant parts (IP, user) into my local configuration file.

Not the answer you're looking for? Browse other questions tagged or ask your own question.