Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

i have a dynamic OpenSSH tunel running as :

ssh -N -D *:1080

(OpenSSH_5.3p1 Debian-3, OpenSSL 0.9.8n 24 Mar 2010)

which runs perfectly for a few hours, of few days, but begin to drop randomly connections (not 100%, only some) yielding :

channel 1019: open failed: administratively prohibited: open failed

I googled it but can't find nothing more than this message spowning in cause of server misconfiguration denying completly the tunnel, here the tunnel works some hours before dropping a few requests.

Any idea ?

share|improve this question
did you ever find the solution to this? – sybind Sep 10 '13 at 2:04
@sybind No, but I continue using ssh -D a lot, without any problem now. Do you experience it ? Which version ? Only a few drops ? – Mandark Sep 11 '13 at 19:19
I did have this problem, somehow fixed it, then I ran into another wall with setting up the routes between the two hosts. The fix may have been related to setting a static arp cache entry.. – sybind Sep 23 '13 at 5:34

I've seen the same message when trying to do a port forward to an unreachable destination:

ssh -L 1337:example.invalid:80

telnet localhost 1337$ channel 3: open failed: administratively prohibited: open failed

share|improve this answer
This can't be that, as my tunnel works some hours before starting to fail, i mean, somtime >24h – Mandark Jun 29 '10 at 7:41
I never said it was :) – Andrew Jun 29 '10 at 7:50

“Administratively prohibited” is also one of the ICMP control messages. Is it possible a router between the SSH server and the tunnel destination is sending this?

If sniffing is possible, a simple pcap filter with just icmp can show you all ICMP traffic.

share|improve this answer
I'll try to dump some ICMP packets next time using tcpdump 'icmp[icmptype] != icmp-echo and icmp[icmptype] != icmp-echoreply' – Mandark Jun 29 '10 at 7:44

Is there a chance you're encountering a bad link? I'm pretty baffled at that message-the only other thing I could think of was a memory issue-do you have plenty of free RAM on the box you're sshed into?

share|improve this answer
I'll check the memory server-side the next time, and wrote it here. The bad link idea : I think not as if i restart the ssh, it works well again – Mandark Jun 28 '10 at 15:22
New one this day, checked client and server health (cpu, memory, logs) nothing particular. – Mandark Jun 29 '10 at 7:40

I had the same problem using authorized_keys with permitopen. On server side, /var/log/auth.log contained:

Received request to connect to host port 10001, but the request was denied.

As I use autossh to create a tunnel, I needed two ports: one for connection (10000) and one for monitoring (10001). The problem came with monitoring port.

In my authorized_keys I had this:

command="/home/user/tunnel",no-X11-forwarding,no-pty,permitopen="localhost:10000",permitopen="localhost:10001" ssh-rsa AAAA

I solved this by replacing localhost instances with

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.