Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

i have a dynamic OpenSSH tunel running as :

ssh -N -D *:1080 user@example.com

(OpenSSH_5.3p1 Debian-3, OpenSSL 0.9.8n 24 Mar 2010)

which runs perfectly for a few hours, of few days, but begin to drop randomly connections (not 100%, only some) yielding :

channel 1019: open failed: administratively prohibited: open failed

I googled it but can't find nothing more than this message spowning in cause of server misconfiguration denying completly the tunnel, here the tunnel works some hours before dropping a few requests.

Any idea ?

share|improve this question
    
did you ever find the solution to this? –  sybind Sep 10 '13 at 2:04
    
@sybind No, but I continue using ssh -D a lot, without any problem now. Do you experience it ? Which version ? Only a few drops ? –  Mandark Sep 11 '13 at 19:19
    
I did have this problem, somehow fixed it, then I ran into another wall with setting up the routes between the two hosts. The fix may have been related to setting a static arp cache entry.. –  sybind Sep 23 '13 at 5:34

3 Answers 3

I've seen the same message when trying to do a port forward to an unreachable destination:

ssh example.com -L 1337:example.invalid:80

telnet localhost 1337

me@example.com:~$ channel 3: open failed: administratively prohibited: open failed

share|improve this answer
    
This can't be that, as my tunnel works some hours before starting to fail, i mean, somtime >24h –  Mandark Jun 29 '10 at 7:41
    
I never said it was :) –  Andrew Jun 29 '10 at 7:50

“Administratively prohibited” is also one of the ICMP control messages. Is it possible a router between the SSH server and the tunnel destination is sending this?

If sniffing is possible, a simple pcap filter with just icmp can show you all ICMP traffic.

share|improve this answer
    
I'll try to dump some ICMP packets next time using tcpdump 'icmp[icmptype] != icmp-echo and icmp[icmptype] != icmp-echoreply' –  Mandark Jun 29 '10 at 7:44

Is there a chance you're encountering a bad link? I'm pretty baffled at that message-the only other thing I could think of was a memory issue-do you have plenty of free RAM on the box you're sshed into?

share|improve this answer
    
I'll check the memory server-side the next time, and wrote it here. The bad link idea : I think not as if i restart the ssh, it works well again –  Mandark Jun 28 '10 at 15:22
    
New one this day, checked client and server health (cpu, memory, logs) nothing particular. –  Mandark Jun 29 '10 at 7:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.