up vote 0 down vote favorite
share [g+] share [fb]

i have a dynamic OpenSSH tunel running as :

ssh -N -D *:1080 user@example.com

(OpenSSH_5.3p1 Debian-3, OpenSSL 0.9.8n 24 Mar 2010)

which runs perfectly for a few hours, of few days, but begin to drop randomly connections (not 100%, only some) yielding :

channel 1019: open failed: administratively prohibited: open failed

I googled it but can't find nothing more than this message spowning in cause of server misconfiguration denying completly the tunnel, here the tunnel works some hours before dropping a few requests.

Any idea ?

link|improve this question
feedback

3 Answers

up vote 1 down vote

“Administratively prohibited” is also one of the ICMP control messages. Is it possible a router between the SSH server and the tunnel destination is sending this?

If sniffing is possible, a simple pcap filter with just icmp can show you all ICMP traffic.

link|improve this answer
I'll try to dump some ICMP packets next time using tcpdump 'icmp[icmptype] != icmp-echo and icmp[icmptype] != icmp-echoreply' – Mandark Jun 29 '10 at 7:44
feedback
up vote 0 down vote

Is there a chance you're encountering a bad link? I'm pretty baffled at that message-the only other thing I could think of was a memory issue-do you have plenty of free RAM on the box you're sshed into?

link|improve this answer
I'll check the memory server-side the next time, and wrote it here. The bad link idea : I think not as if i restart the ssh, it works well again – Mandark Jun 28 '10 at 15:22
New one this day, checked client and server health (cpu, memory, logs) nothing particular. – Mandark Jun 29 '10 at 7:40
feedback
up vote 0 down vote

I've seen the same message when trying to do a port forward to an unreachable destination:

ssh example.com -L 1337:example.invalid:80

telnet localhost 1337

me@example.com:~$ channel 3: open failed: administratively prohibited: open failed

link|improve this answer
This can't be that, as my tunnel works some hours before starting to fail, i mean, somtime >24h – Mandark Jun 29 '10 at 7:41
I never said it was :) – Andrew Jun 29 '10 at 7:50
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.