How to fix channel 0: open failed: administratively prohibited: open failed in SSH

First, verify that standard SSH connection works without forwarding:

ssh user@hostname

If you can log in successfully, the issue is specifically with the requested channel operation (forwarding, tunneling, etc.), not the connection itself. This confirms it's a server-side configuration restriction.

Identify whether the error occurs with port forwarding, tunneling, SFTP, or X11. Each has different fixes:

Local port forwarding:

ssh -L 8080:localhost:80 user@hostname
# If this fails with 'administratively prohibited', AllowTcpForwarding is disabled

Remote port forwarding:

ssh -R 8080:localhost:80 user@hostname
# Requires AllowTcpForwarding and GatewayPorts enabled

SFTP:

sftp user@hostname
# Requires Subsystem sftp configured in sshd_config

X11 forwarding:

ssh -X user@hostname
# Requires X11Forwarding enabled

Use verbose mode to see exactly what is being denied:

ssh -vvv -L 8080:localhost:80 user@hostname 2>&1 | grep -A 2 'administratively'

If you have root access to the SSH server, edit /etc/ssh/sshd_config:

sudo nano /etc/ssh/sshd_config

Find or add this line:

AllowTcpForwarding yes

If the line starts with #, uncomment it. Then restart sshd:

On systemd systems:

sudo systemctl restart sshd

On older systems:

sudo service sshd restart

For remote port forwarding specifically, also ensure:

GatewayPorts yes

This allows other machines to connect to the forwarded port (otherwise only localhost can connect).

On the remote server, the SSH public key in authorized_keys may have restrictions. Check the key:

cat ~/.ssh/authorized_keys | grep -i "no-port"

If you see directives like no-port-forwarding or no-pty, they block the operation. To remove them:

# Backup first
cp ~/.ssh/authorized_keys ~/.ssh/authorized_keys.bak

# Edit and remove no-port-forwarding, no-pty, restrict, etc.
nano ~/.ssh/authorized_keys

The key should start directly with ssh-rsa or ssh-ed25519 with no prefix directives.

If the server admin wants to allow port forwarding but only to specific destinations, they can use PermitOpen:

sudo nano /etc/ssh/sshd_config

To allow forwarding to specific ports:

PermitOpen any

Or restrict to specific hosts/ports:

PermitOpen localhost:3306
PermitOpen 192.168.1.5:5432

Then restart sshd:

sudo systemctl restart sshd

If PermitOpen is set and you're being denied, ask the admin to either add your destination to the list or set PermitOpen to 'any'.

If you're connecting to a managed server (cloud provider, shared host, company infrastructure) and you don't have root access, contact the system administrator with this information:

1. Request: Enable AllowTcpForwarding in sshd_config for your user (or globally if acceptable)
2. Reason: "I need port forwarding for [your use case]"
3. Secure alternative: If full forwarding can't be enabled, ask if PermitOpen can be configured to allow only your specific target host/port

Example message to admin:

Hello, I need SSH port forwarding capability for my key (fingerprint: xxx).
The server is currently denying 'administratively prohibited' errors when I attempt
port forwarding. Could you please:
- Enable AllowTcpForwarding in /etc/ssh/sshd_config, or
- Add PermitOpen for the specific hosts/ports I need to access?