Using ssh -t works to connect over a Jump Host but ssh -W does not work

Question

I'm trying to connect my computer LocalClient to RemoteHost via a JumpHost that I have no control over. I have complete control of the client and RemoteHost (admin privileges)

I can connect to the RemoteHost from LocalClient perfectly via ssh as:

ssh -tX relayUserName@JumpHost remoteUser@RemoteHostIP

My ~/.ssh/config file has the config as:

Host RemoteHost
    ProxyCommand ssh -W %h:%p JumpHost

Now, if I try to tunnel through the RemoteHost, I get an error as:

channel 0: open failed: administratively prohibited: open failed
stdio forwarding failed

Using ssh -v, I get a little more information

Authenticated to <JumpHost> ([JumpHostIP]:22).
debug1: channel_connect_stdio_fwd RemoteHostIP:22
debug1: channel 0: new [stdio-forward]
debug1: getpeername failed: Bad file descriptor
debug1: Requesting [email protected]
debug1: Entering interactive session.
debug1: pledge: network
channel 0: open failed: administratively prohibited: open failed
stdio forwarding failed
ssh_exchange_identification: Connection closed by remote host

Based on this answer, I've checked the values of sshd_config in /etc/ssh/ on RemoteHost and (manually) set

AllowTcpForwarding yes

The problem still persists and I don't know what else to try.

Details:

• OS: RemoteHost and LocalClient : Kubuntu 18.04 LTS
• ssh versions (arrived via ssh -v ) : RemoteHost and LocalClient: OpenSSH_7.6p1 Ubuntu-4ubuntu0.3, OpenSSL 1.0.2n 7 Dec 2017
• ssh version: JumpHost (arrived via ssh -v debug1):

debug1: Local version string SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.3
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH_5* compat 0x0c000000

---

As a side note, I need to tunnel to the RemoteHost to access a Jupyter Lab instance running with --no-browser --port=8889 and forward it to my LocalClient's port 8888 for accessing my experiments remotely via a browser on localhost:8888

Answer 1

ProxyCommand ssh -W %h:%p JumpHost establish forwarding on JumpHost between ssh stdio and %h:%p (which is RemoteHost for your case).

This means the AllowTcpForwarding yes configuration must be set on JumpHost's sshd_config. Not RemoteHost as only JumpHost is doing the forwarding from stdio to RemoteHost.

If you can't change sshd_config on JumpHost, you should be able to use this instead, in your ~/.ssh/config:

Host RemoteHost
    ProxyCommand ssh JumpHost netcat %h %p

This will do the same as ssh -W, but with basic commands, so the ssh server on JumpHost won't deny it even with AllowTcpFowarding no.

It uses netcat program on JumpHost to redirect ProxyCommand's ssh stdio to another host like this:

interactive ssh <= stdio => ProxyCommand's ssh <= network => JumpHost's sshd <= stdio => netcat <= network => RemoteHost

See also: https://www.cyberciti.biz/faq/linux-unix-ssh-proxycommand-passing-through-one-host-gateway-server/