2

I have a problem with port forwarding in centos 6, when i do:

ssh -v -R root@hostname:19999:localhost:22 root@hotname

I get this warning:

Warning: remote port forwarding failed for listen port 19999

The ssh session starts but i cannot use it as a tunnel, the complete output is this:

OpenSSH_5.3p1, OpenSSL 1.0.1e-fips 11 Feb 2013
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to hostname [ip.ip.ip.ip] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file /root/.ssh/identity type -1
debug1: identity file /root/.ssh/identity-cert type -1
debug1: identity file /root/.ssh/id_rsa type -1
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: identity file /root/.ssh/id_dsa type -1
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.3
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host 'hostname' is known and matches the RSA host key.
debug1: Found key in /root/.ssh/known_hosts:2
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure.  Minor code may provide more information
Credentials cache file '/tmp/krb5cc_0' not found

debug1: Unspecified GSS failure.  Minor code may provide more information
Credentials cache file '/tmp/krb5cc_0' not found

debug1: Unspecified GSS failure.  Minor code may provide more information


debug1: Unspecified GSS failure.  Minor code may provide more information
Credentials cache file '/tmp/krb5cc_0' not found

debug1: Next authentication method: publickey
debug1: Trying private key: /root/.ssh/identity
debug1: Trying private key: /root/.ssh/id_rsa
debug1: Trying private key: /root/.ssh/id_dsa
debug1: Next authentication method: password
hostname's password: 
debug1: Authentication succeeded (password).
debug1: Remote connections from root@hostname:19999 forwarded to local address localhost:22
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions@openssh.com

debug1: Entering interactive session.
debug1: remote forward failure for: listen 19999, connect localhost:22
Warning: remote port forwarding failed for listen port 19999
debug1: All remote forwarding requests processed
debug1: Sending environment.
debug1: Sending env LANG = en_US.UTF-8
Last login: Sun Jul 21 17:24:54 2013 from 172.16.63.56

during the connection i get in /var/log/secure the messages:

Jul 21 18:30:09 localhost sshd[11816]: Accepted password for root from 172.16.63.56 port 52035 ssh2
Jul 21 18:30:09 localhost sshd[11816]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jul 21 18:30:09 localhost sshd[11816]: error: channel_setup_fwd_listener: getaddrinfo(root@hostname): Name or service not known

I can do the same command from another pc with ubuntu and it works perfectly, and i am sure that port 19999 is free. What can i do?

  • Have you checked the logging that occurs on the SSHD side? – Andrew Stubbs Jul 21 '14 at 16:17
  • where do i find it? – Luca Jul 21 '14 at 16:25
  • There may be something in /var/log/messages, or possibly in /var/log/secure. – Andrew Stubbs Jul 21 '14 at 16:28
  • i have added the message given bu the host in /var/logs/secure – Luca Jul 21 '14 at 16:36
  • How are you sure that 19999 is free? netstat output? – ernie Jul 21 '14 at 16:49
4

Try leaving off the "root@" portion of the -R argument:

ssh -v -R hostname:19999:localhost:22 root@hostname

With the four-parameter version of -R, the four parameters are the address and port to listen for connections on the remote host, and the address and port to forward to from the local host.

You're giving a value of "root@hostname" as the remote bind host/address. This value should just be a hostname or IP address; ssh doesn't expect this value to include a username. ssh is probably trying to look up the entire string "root@hostname" as a hostname and failing.

  • Thank you buddy, you are my hero! that error completely confuse me. I hope this question will save hours of work for somebody else. – Luca Jul 22 '14 at 17:15
0

I was just struggeling with this same issue on RHEL7, but additionally complicated with that the user I was connecting to was a SElinux confined as "user_u". The audit.log was logging these:

23. 12/09/2015 12:24:40 sshd user_u:user_r:user_t:s0 49 tcp_socket name_bind system_u:object_r:unreserved_port_t:s0 denied 8595602
24. 12/09/2015 12:24:40 sshd user_u:user_r:user_t:s0 49 tcp_socket name_bind system_u:object_r:unreserved_port_t:s0 denied 8595603

but it always takes me a while before figuring out I should be looking there :-)

To fix this, I had to use a port in the ephemeral_port_t range.

SELinux Port Type              Proto    Port Number
ephemeral_port_t               tcp      32768-61000
ephemeral_port_t               udp      32768-61000

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.