SSH Tunnel: channel 3: open failed: administratively prohibited

Question

I have two servers, let's say server A and server B. I wish to use server B as an ssh tunnel so on server A I did this

ssh -D 1080 root@ip

It connects and as soon as I put in the server B as a SOCKS5 proxy on my server A, the server B comes up with this erorr:

channel 3: open failed: administratively prohibited

Some how if I get server B from a host like vultr, I don't get this error but if I get it from digitalocean I get this error. I did some research and saw I should allowtcpforwarding to be yes but I could not find it in /etc/ssh/ssh_config

This is my ssh_config file:

# Host *
#   ForwardAgent no
#   ForwardX11 no
#   RhostsRSAAuthentication no
#   RSAAuthentication yes
#   PasswordAuthentication yes
#   HostbasedAuthentication no
#   GSSAPIAuthentication no
#   GSSAPIDelegateCredentials no
#   GSSAPIKeyExchange no
#   GSSAPITrustDNS no
#   BatchMode no
#   CheckHostIP yes
#   AddressFamily any
#   ConnectTimeout 0
#   StrictHostKeyChecking ask
#   IdentityFile ~/.ssh/identity
#   IdentityFile ~/.ssh/id_rsa
#   IdentityFile ~/.ssh/id_dsa
#   IdentityFile ~/.ssh/id_ecdsa
#   IdentityFile ~/.ssh/id_ed25519
#   Port 22
#   Protocol 2
#   Cipher 3des
#   Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc
#   MACs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160
#   EscapeChar ~
#   Tunnel no
#   TunnelDevice any:any
#   PermitLocalCommand no
#   VisualHostKey no
#   ProxyCommand ssh -q -W %h:%p gateway.example.com
#   RekeyLimit 1G 1h

Would appreciate if someone could tell me what am I doing wrong :3

Answer 1

The config file you need to edit is called sshd_config you wrote ssh_config. What you have listed looks like the contents of the ssh client default configuration, not the config for the ssh server (/etc/ssh/sshd_config)

Answer 2

What you list is just the default values, commented out.

So you can add, below a Host * something like:

AllowTcpForwarding local

Note that yes should be the default, so it is strange it does not work. You can add more verbosity with ssh -v or -vv or -vvv and have a look at your server sshd logfile that should provide more information on what is wrong.

Answer 3

You likely need to set AllowTcpForwarding yes in the sshd_config on the server to allow this to happen.

Answer 4

First, check for entries in /var/log/secure for something like this;

Feb  1 19:59:58 vps001 sshd[30375]: error: connect_to 
www.somenonexistingdomain.com: unknown host (Name or service not known)

second, check whether selinux is blocking; (if you are RedHat based))

$ sudo ausearch -m avc -c httpd
----
time->Sat Jan  6 08:58:11 2018
type=AVC msg=audit(1515229091.030:7212): avc:  denied  { map } for  pid=20581 comm="httpd" path="/var/

you can test and disable selinux like so;

[~] $ sudo getenforce
Enforcing

[~] $ sudo setenforce Permissive

[~] $ sudo getenforce
Permissive

then test and see if it is now working.

[~] $ sudo setenforce Enforcing

I get the open failed: administratively prohibited behaviour if the server cannot connect to the site you are requesting on the other side.

For example, if I send a request for www.somenotexistingdomain.com via a socks 5 proxy ssh -S none -D1083 -vvv my.cheap.vps.com, it results in this output;

debug1: Connection to port 1083 forwarding to socks port 0 requested.
debug2: fd 10 setting TCP_NODELAY
debug2: fd 10 setting O_NONBLOCK
debug3: fd 10 is O_NONBLOCK
debug1: channel 4: new [dynamic-tcpip]
....
debug2: channel 4: dynamic request: socks5 host www.somenonexistingdomain.com port 80 command 1
debug3: send packet: type 90
debug3: receive packet: type 92
channel 4: open failed: administratively prohibited: open failed
debug2: channel 4: zombie
debug2: channel 4: garbage collecting
debug1: channel 4: free: direct-tcpip: listening port 1083 for www.somenonexistingdomain.com port 80, connect from 127.0.0.1 port 42598 to 127.0.0.1 port 1083, nchannels 22

and you can see that it cannot connect.

If you are sure that the server you are trying to access exists; For example, first test that you can wget or curl the site from the command line remotely.

$ wget -S -O - www.bbc.co.uk > /dev/null
Resolving www.bbc.co.uk (www.bbc.co.uk)... 212.58.244.69, 212.58.246.93
Connecting to www.bbc.co.uk (www.bbc.co.uk)|212.58.244.69|:80... connected.
HTTP request sent, awaiting response... 
HTTP/1.1 301 Moved Permanently
Server: nginx

If that doesn't work, then its possible that if you are forwarding to the proxy DNS, is that the remote server cannot resolve the DNS. So check that;

$ dig www.bbc.co.uk +short
www.bbc.net.uk.
212.58.246.91
212.58.244.67

and also check direct connection to the port using netcat, telnet etc. however pulling the site with wget should have tested both tcp connection and DNS.

$ telnet www.bbc.co.uk 80
Trying 212.58.244.26...
Connected to www.bbc.co.uk.
Escape character is '^]'.

and definitely check the entries in the /var/log/secure file.

Failing that turn logging right up (ssh -vvvvvvv) and watch both sides of the connection.