Using my user I'm able to set up an ssh tunnel to mysql (port 3306) on an internal server by tunneling through an external server using:

ssh -L 33306:localhost:33306 [email protected] ssh -L 33306:localhost:3306 me@internal

I'm then able to log into mysql with:

mysql -h -P 33306 -u me -p my_database

Now, I'd like to set up another user to be able to do the same but not be able to do anything else (not login, access other ports, etc).

In their authorized_keys on external.com I have:

permitopen="internal:3306",permitopen="localhost:33306",no-pty ssh-rsa AAAA...== 

I don't have any restrictions in their authorized_keys on internal (not sure if I need them - will explore once I get this working).

Then, when I do:

mysql -h -P 33306 -u me -p my_database

It seems to work in that it asks for my password. I enter the password, but then mysql gives me:

Enter password: 
ERROR 2013 (HY000): Lost connection to MySQL server at 'reading initial communication packet', system error: 0

and in the terminal where I set up the tunnel I get:

channel 3: open failed: administratively prohibited: open failed

When it asks for the mysql password is that just happening locally before it tries to communicate with the server? Are my permitopen flags wrong?

1 Answer 1


Nevermind. The problem is that I had set that user to not have a shell on both machines so that they could only use the first server as a tunnel.

The above command actually does work.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .