Discussion between Lambert and Badr Oyd - 2015-04-21

last day (15 days later) »

10:43 AM

0

Q: Channel 0: open failed: administratively prohibited: open failed

I was doing this tutorial, but when it comes to the part where i should set this commands : local-server# ssh -NTCf -w 0:0 87.117.217.27 local-server# ssh -NTCf -w 1:1 87.117.217.44, It says : channel 0: open failed: administratively prohibited: open failed How can i fix that ?

ssh ssh-tunneling failure

Are you using the root account as stated in the tutorial: 'from the root account of your local server'?

@Lambert Yes, i'm using root account and commands are sent from a #

You changed the public IP addresses (87.117.217.27, 87.117.217.44) to match your own right?

Yes of course, i'm using 172.16.2.1 and 172.16.20.1

Did you find and read unix.stackexchange.com/questions/14160/…?

10:43 AM

Yes, i've tried all those things but it gives me the same failure

Did you try to add -v to the command to see verbose information?

And, can you post the result of a verbose action?

one second, i'll try that

where should i add the -v ?

you can add it in front of -NTCf

ok, one sec

multiple -v gives you more detailed information (i.e. -vvv for debug level 3)

10:47 AM

root@ubuntu:~# ssh -NTCf -v -w 0:0 172.16.2.1
OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to 172.16.2.1 [172.16.2.1] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file /root/.ssh/id_rsa type 1
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: identity file /root/.ssh/id_dsa type -1
debug1: identity file /root/.ssh/id_dsa-cert type -1

ah right

You see the 'debug1: Remote: Server has rejected tunnel device forwarding'

Yes

i should enable TCPForwarding ?

Did you enable the PermitTunnel entries:

PermitRootLogin without-password
PermitTunnel yes
PasswordAuthentication no

on remote server ?

and have you restarted the ssh server process after reconfiguration?

It's specified in section "Creating VPN Tunnels - Using SSH" of the tutorial

Quote: You need to edit your /etc/ssh/sshd_config file on your Remote Server

So, yes, on the remote server

10:51 AM

Yes, i edited it, on my server it's on /etc/ssh/ssh_config

i ll try it a second time

ssh_config is for client side configuration, sshd_config is for server configuration

oh

i only changed the ssh_config

so you need to add those configuration directives into /etc/ssh/sshd_config on the remote server

you can leave /etc/ssh/ssh_config on the remote server untouched.

ok, one second

yes i ll put it's default settings back

according to the tutorial you do not need to modify the /etc/ssh/ssh_config on the local server either

10:56 AM

i changed the config

/etc/init./ssh restart

INITD

initd *

yes

it is probably sshd

/etc/init.d/sshd restart on the remote server

No such file or directory

i think i should add tcpforwording on sshd_config

but you do have ssh started on the remote server?

yes

You can try to enable tcpforwarding but I don't think it will help since you are not forwarding any ports (using -L or -R directives)

you need to restart sshd after reconfiguration

please see which ssh processes are running on the remote server using ps -ef |grep sshd

you can also try to reload the server process by pkill -HUP sshd

11:02 AM

i ll try that

one second please

root@ubuntu:~# ps -ef | grep sshd
root 1170 1 0 01:01 ? 00:00:00 /usr/sbin/sshd -D
root 4103 1170 0 02:19 ? 00:00:00 sshd: root
root 4194 1170 0 02:20 ? 00:00:00 sshd: root
root 4276 1170 0 02:30 ? 00:00:00 sshd: root
root 4322 1170 0 02:30 ? 00:00:00 sshd: root
root 4390 1170 0 02:35 ? 00:00:00 sshd: root
root 4480 1170 0 02:45 ? 00:00:00 sshd: root
root 4541 1170 0 02:49 ? 00:00:00 sshd: root

So, you have al lot of sshd processes, but nothing you should worry about, most of them are regular sessions

see the parent PID 1170, pointing to your actual sshd server process

where ? :o

first field is user running process, second field is PID, third field is Parent PID. PID is process ID, all sshd processes are 'childs' of process with PID 1170: /usr/sbin/sshd -D

to restart the sshd process on the remote server you also can use service sshd reload or service sshd restart

root@ubuntu:~# service sshd restart
sshd: unrecognized service

pretty strange

11:09 AM

i think ou mean service ssh restart

indeed

after restarting ssh

i got another failure :/

root@ubuntu:~# ssh -NTCf -v -w 0:0 172.16.2.1
OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to 172.16.2.1 [172.16.2.1] port 22.
debug1: connect to address 172.16.2.1 port 22: Connection refused
ssh: connect to host 172.16.2.1 port 22: Connection refused

Can it be the case that you made a configuration mistake (typo) in the sshd_config on the remote server so the service will not start?

i'm pretty sure i didn't make a mistake

try sshd -t on the remote server

11:12 AM

i fixed it

it will perform a syntax/configuration check

PermitTunnel was the problem

but

great

the first failure is still there

sure, if you do not have the permittunnel enabled...

11:13 AM

i ll try AllowedTCPForwarding

did you remove the permittunnel directive?

Yes because i've added it before it made the second failure

Sure, but what did sshd -t say with the PermitTunnel directive?

one sec i'll try that

on remote server ?

should i make the PermitTunnel back before?

on the remote server

yes

add 'PermitTunnel yes' to the configuration on the remote server

then do a sshd -t

11:17 AM

i think i should restart before ?

If it does not complain, do service ssh restart

sshd -t shows nohing

Then the syntax is right

ohhh

thank you

it's fixed

nice

11:18 AM

i think i made a syntax mistake before

:-)

root@ubuntu:~# ssh -NTCf -w 0:0 172.16.2.1
Tunnel device open failed.
Could not request tunnel forwarding.

That will bring you a step further...

it's working now

thank you lambert

You can add your anwser to get some points if you want ^^

Nice, will do.

Will add the following as answer:

After discussing this in a chat it turned out that the required directive PermitTunnel yes was not in place and active. After adding the directive to /etc/ssh/sshd_config and reloading sshd by service sshd reload this was resolved.

Is that also the answer according to you?

11:22 AM

Perfect

Yes

Great. Have fun, and a nice day

shoud i add the debug to my question too ?

Thank you, have a nice day too ^^

Yes, I will edit the answer to add it

ok thanks :)

last day (15 days later) »

Transcript for

Apr '1521

Discussion between Lambert and Badr Oyd

Imported from a comment discussion on unix.stackexchange.com/q...

failure ssh ssh-tunneling

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile