Proxy Jumps now disabled

[johannes-bauer]

It used to be possible to use an SSH server running in a container from this image as a proxy jump server as in ssh -J <jump-host> target-host or using a ProxyJump directive in an ./ssh/config.

That seems to be disabled now (getting 'channel 0: open failed: administratively prohibited'). Apparently, the default value for the PermitTunnel directive in /etc/ssh/sshd_config has changed from yes to no.

Expected Behavior

Starting a container using this image, I can run ssh -J <container host> <target host reachable from container> and ssh into the target host through the container.

(alternative to configure ProxyJump in ~/.ssh/config)

Current Behavior

When connecting as above, I get 'channel 0: open failed: administratively prohibited'

Steps to Reproduce

Start server:

[me@my-desk]$ docker run \
  --rm \
  -e USER_PASSWORD=a \
  -e PASSWORD_ACCESS=true \
  -p 2222:2222 \
  ghcr.io/linuxserver/openssh-server

[me@my-desk]$ ssh -J linuxserver.io@localhost:2222 git@github.com 
linuxserver.io@localhost's password: 
channel 0: open failed: administratively prohibited: open failed
stdio forwarding failed
kex_exchange_identification: Connection closed by remote host
Connection closed by UNKNOWN port 65535

Discussion:

I'm not sure: should this be enabled by default? Should this be another configuration option of this image? Or should users just modify their images or mount custom configs if they need this?

Personally, I do need this functionality.

[github-actions]

Thanks for opening your first issue here! Be sure to follow the bug or feature issue templates!

[johannes-bauer]

Workaround:

Volume-mount a file with the following contents to /etc/cont-init.d/88-enable_tunnels

#!/usr/bin/with-contenv bash

echo Enabling Tunneling
sed -i 's@#PermitTunnel no@PermitTunnel yes@' /etc/ssh/sshd_config

[aptalca]

I'm pretty sure it always had #PermitTunnel no so perhaps you changed it before.

But yes, a custom script is the way to go in this case

[johannes-bauer]

I didn't, it just worked. Weird.

Anyway---fine by me, probably not worth another config option.

[sharpe5]

The solution below fixes this error:

Could not establish connection from local ('127.0.0.1', 14988) to remote ('localhost', 27017) side of the tunnel: open new channel ssh error: ChannelException(1, 'Administratively prohibited')

Create a new file Dockerfile-ssh-server which inherits from the base image, but edits /etc/ssh/sshd_config to allow tunnel and TCP forwarding:

FROM ghcr.io/linuxserver/openssh-server
# Enable tunnelling or else we cannot connect to MongoDB via SSH:
# - Fixes observed error: "Could not establish connection from local ('127.0.0.1', 14988) to remote ('localhost', 27017) side of the tunnel: open new channel ssh error: ChannelException(1, 'Administratively prohibited')"
# - Ref: https://github.com/linuxserver/docker-openssh-server/issues/43
# - Ref: https://unix.stackexchange.com/questions/14160/ssh-tunneling-error-channel-1-open-failed-administratively-prohibited-open
RUN sed -i 's@#PermitTunnel no@PermitTunnel yes@' /etc/ssh/sshd_config
RUN sed -i 's@AllowTcpForwarding no@AllowTcpForwarding yes@' /etc/ssh/sshd_config

Then in docker-compose.yml, import from this new DockerFile instead of the original image:

  openssh-server:
    # This has "permitTunnel no" and "AllowTcpForwarding no" which prevents SSH from working ...
    # image: ghcr.io/linuxserver/openssh-server
    # ... so use this new Dockerfile which inherits and corrects these settings:
    build:
      context: .
      dockerfile: Dockerfile-ssh-server
    container_name: openssh-server

I believe that this should be available as a configuration setting, as there are many use cases where SSH tunnelling is required, e.g. using Python + SSHTunnel + PyMongo.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[xuan-w]

For what I saw as of today, PermitTunnel option is irrelevant to this problem. OpenSSH man page says nothing about PermitTunnel and port forwarding.
For me, changing AllowTcpForwarding solved the problem for ProxyJump. I changed it in the mounted config folder, no need to create a new dockerfile.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[imjuzcy]

There is a sshd_config in /config/ssh_host_keys/sshd_config. It is not documented, but I assume it is copied to /etc/ssh/sshd_config on container start, so one can just edit this file instead of relying on the cont-init.d script