Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

ive been trying to setup a VPN SSH tunnel and ive had success executing ssh -Nv -w 0:0 root@ -p 50

however what i am wondering is, can i do the tunneling without having root unlocked when i try ssh -Nv -w 0:0 $username@ -p 50 and have root acccount disabled while $username is set in sudoers, i get an administratively prohibited

so my question is, can i do the tunnel without having root enabled? thnx :)

share|improve this question
+1 I like the question, I have the same intentions (vpn tunnel) and I assume having root login enabled cannot be a good solution in the long run, can it? – humanityANDpeace Mar 29 '13 at 6:50
up vote 2 down vote accepted

Normally on most distributions of Linux you can't bind to ports lower than 1024 without privileges.

It may however be that what you want to do can be achieved a different way. For example, if you are a web developer trying to work remotely you may want to use a Dynamic tunnel in Putty as a SOCKs proxy to have your browser requests come out at the destination server's end. Also any local port forwarding done with an SSH tunnel is reliant on permissions at the connecting user's end, not the server end. The only time permissions becomes an issue is when doing a Remote tunnel.

If you want to fully VPN over SSH, some customisation will be required at both ends. See this guide for quite a thorough walk through. That guide describes the process with a Linux remote user connecting to a Linux server. The process is not as simple (I don't even know how you'd do it nicely!) if the remote user is running Windows.

share|improve this answer
yea i found that article along with another and they were quite helpful and thank you for clarifying the ports privileges :D – NetSkay Jan 9 '12 at 17:08
@SimonJGreen You mention that non-root users can bind to ports <1024. Would this mean, that this is the reason why ssh-vpn would not work? And if so, is there a reason to use a port <1024 why not using any port in 1024 - 65000 ? – humanityANDpeace Mar 29 '13 at 6:48

A variation of that question would be: Can you lock down an ssh VPN over the root account so that the tun* devices can be setup but nothing else can be done? (shell, file transfer, port fwd, etc.)

This list of security options for sshd, etc may help figure this out:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.