Re: openssh port forwarding administratively prohibited

[Ryan Johnson <ryanjohn at ece dot cmu dot edu>]

 On 8:59 PM, Maring, Steven wrote:
>  From a 50K foot perspective, what I'm trying to do is punch a hole through my corporate http proxy to get to github.  By itself, cygwin, along with openssh and corkscrew, does not have a problem (i.e. remote git commands work).  However, I would also like to make use of the eGit Eclipse plugin, which unfortunately does not support the notion of a proxy.  So, I thought that if I could setup a local port forwarding I might be able to get eGit to connect ... but it isn't working.I've included the openssh, git, and corkscrew packages in my cygwin install.
>
> I then ran ssh-host-config, but I didn't think actually running the sshd via 'net start sshd' would be required.  The port forwarding does not seem to work either way.
<snip>
> $ ssh -L 22:github.com:22 -v -N git@github.com
<snip>
> and then try to connect from another console like this ...
>
> $ ssh -v -N git@localhost
<snip>
> then my tunnel says ...
>
> debug1: Connection to port 22 forwarding to github.com port 22 requested.
> debug1: channel 1: new [direct-tcpip]
> channel 1: open failed: administratively prohibited: open failed
> debug1: channel 1: free: direct-tcpip: listening port 22 for github.com port 22, connect from 127.0.0.1 port 1130, nchannels 2
This sounds like a vanilla ssh issue to me rather than anything 
cygwin-specific.

Several things come to mind right off. First, I've seen the 
"administratively prohibited" message when there was no port forwarding 
in place at all. Not the most intuitive message, but whatever...

Second, it's often "difficult" to forward to "privileged" ports (< 
1024), though that wasn't a problem when I tested it on my cygwin install.

Finally (and probably the real issue) ssh-host-config sets things up for 
(and starts) the sshd service, which means port 22 on your machine is 
already in use and the port forwarding comes up empty-handed. Try "net 
stop sshd", or else tell ssh "-L 2222:github.com:22" and see if that 
gets you anywhere (I don't use git but I assume there's a way to point 
it at ports besides the default 22). Note that connecting this way will 
mess up the known_hosts file and make ssh yell at you if you ever happen 
to ssh to localhost (or to any other machine tunneled to localhost). I 
think there are ways around this with aliases or something... man 
ssh_config?

Regards,
Ryan


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple