How to fix channel 0: open failed: administratively prohibited: open failed in SSH

SSHINTERMEDIATEMEDIUMUpdated Jan 4, 2026· 479 views

This error occurs when the SSH server (sshd) denies a channel opening request for port forwarding, tunneling, or subsystem operations. It means the server is configured to administratively prohibit the requested operation, even though the authentication succeeded.

Quick fix

Fixes channel 0: open failed: administratively prohibited: open failed

ssh user@hostname
  1. Test basic SSH connection
  2. Check which operation is failing
  3. Enable AllowTcpForwarding if you control the server
  4. Check authorized_keys for key restrictions
ssh — error
ssh user@hostname
channel 0: open failed: administratively prohibited: open failed

What this error means

When you attempt to use SSH features like local port forwarding (-L), remote port forwarding (-R), SFTP/SCP, or X11 forwarding, SSH must open a channel on the remote server to handle the operation. This error message indicates the SSH server has accepted your authentication but explicitly rejects the channel open request because it is administratively prohibited. This typically happens due to sshd configuration restrictions that limit which operations are allowed, which users can use certain features, or which specific ports/hosts can be accessed through forwarding.

Typical symptoms

  • SSH connection itself works (you can log in), but specific features fail
  • Local or remote port forwarding with -L or -R flags fails immediately
  • SFTP or SCP transfers fail with subsystem request error
  • X11 forwarding with -X or -Y flags fails
  • Error message shows 'channel N: open failed: administratively prohibited'
  • Command works on some servers but not others

Common causes

  1. AllowTcpForwarding is set to 'no' in /etc/ssh/sshd_config on the server
  2. PermitOpen is restricted to specific destinations and your target is not in the list
  3. PermitTunnel is set to 'no', preventing tunnel requests
  4. User-specific SSH key restrictions in authorized_keys (no-port-forwarding directive)
  5. GatewayPorts is disabled and you are attempting remote forwarding (-R)
  6. X11Forwarding is disabled and you are attempting X11 forwarding (-X)
  7. Match block in sshd_config restricts certain users or IP addresses
  8. The server's SSH daemon configuration doesn't permit subsystem requests needed for SFTP

How to fix "channel 0: open failed: administratively prohibited: open failed"

1Test basic SSH connection

First, verify that standard SSH connection works without forwarding:

bash
ssh user@hostname

If you can log in successfully, the issue is specifically with the requested channel operation (forwarding, tunneling, etc.), not the connection itself. This confirms it's a server-side configuration restriction.

2Check which operation is failing

Identify whether the error occurs with port forwarding, tunneling, SFTP, or X11. Each has different fixes:

Local port forwarding:

bash
ssh -L 8080:localhost:80 user@hostname
# If this fails with 'administratively prohibited', AllowTcpForwarding is disabled

Remote port forwarding:

bash
ssh -R 8080:localhost:80 user@hostname
# Requires AllowTcpForwarding and GatewayPorts enabled

SFTP:

bash
sftp user@hostname
# Requires Subsystem sftp configured in sshd_config

X11 forwarding:

bash
ssh -X user@hostname
# Requires X11Forwarding enabled

Use verbose mode to see exactly what is being denied:

bash
ssh -vvv -L 8080:localhost:80 user@hostname 2>&1 | grep -A 2 'administratively'
3Enable AllowTcpForwarding if you control the server

If you have root access to the SSH server, edit /etc/ssh/sshd_config:

bash
sudo nano /etc/ssh/sshd_config

Find or add this line:

bash
AllowTcpForwarding yes

If the line starts with #, uncomment it. Then restart sshd:

On systemd systems:

bash
sudo systemctl restart sshd

On older systems:

bash
sudo service sshd restart

For remote port forwarding specifically, also ensure:

bash
GatewayPorts yes

This allows other machines to connect to the forwarded port (otherwise only localhost can connect).

4Check authorized_keys for key restrictions

On the remote server, the SSH public key in authorized_keys may have restrictions. Check the key:

bash
cat ~/.ssh/authorized_keys | grep -i "no-port"

If you see directives like no-port-forwarding or no-pty, they block the operation. To remove them:

bash
# Backup first
cp ~/.ssh/authorized_keys ~/.ssh/authorized_keys.bak

# Edit and remove no-port-forwarding, no-pty, restrict, etc.
nano ~/.ssh/authorized_keys

The key should start directly with ssh-rsa or ssh-ed25519 with no prefix directives.

5Configure PermitOpen for specific forwarding restrictions

If the server admin wants to allow port forwarding but only to specific destinations, they can use PermitOpen:

bash
sudo nano /etc/ssh/sshd_config

To allow forwarding to specific ports:

bash
PermitOpen any

Or restrict to specific hosts/ports:

bash
PermitOpen localhost:3306
PermitOpen 192.168.1.5:5432

Then restart sshd:

bash
sudo systemctl restart sshd

If PermitOpen is set and you're being denied, ask the admin to either add your destination to the list or set PermitOpen to 'any'.

6If you don't control the server, request admin changes

If you're connecting to a managed server (cloud provider, shared host, company infrastructure) and you don't have root access, contact the system administrator with this information:

1. Request: Enable AllowTcpForwarding in sshd_config for your user (or globally if acceptable)
2. Reason: "I need port forwarding for [your use case]"
3. Secure alternative: If full forwarding can't be enabled, ask if PermitOpen can be configured to allow only your specific target host/port

Example message to admin:

bash
Hello, I need SSH port forwarding capability for my key (fingerprint: xxx).
The server is currently denying 'administratively prohibited' errors when I attempt
port forwarding. Could you please:
- Enable AllowTcpForwarding in /etc/ssh/sshd_config, or
- Add PermitOpen for the specific hosts/ports I need to access?

Advanced notes

ProxyJump and Jump Hosts: When using ProxyJump (-J flag), all intermediate SSH servers in the chain must have AllowTcpForwarding enabled, not just the final destination. If any intermediate server denies it, the whole connection fails.

Docker and Kubernetes SSH Containers: SSH inside containers may have minimal sshd_config. If you're connecting to a containerized SSH service, the container image might disable forwarding by default. You'll need to rebuild with the correct sshd_config or use a different networking approach.

Relative vs. Absolute Forwarding: The error number (0, 1, 2, etc.) indicates the channel number. Channel 0 is typically the first attempted operation. If you see multiple errors with different channel numbers, multiple operations are being attempted and all are denied.

SSH Subsystem Restrictions: For SFTP specifically, ensure the subsystem line exists in sshd_config: Subsystem sftp /usr/lib/openssh/sftp-server. The "administratively prohibited" error for SFTP might also indicate a missing subsystem definition.

SELinux and AppArmor: On hardened systems, SELinux policies or AppArmor profiles might enforce additional SSH restrictions beyond sshd_config. If enabling forwarding in config doesn't work, check: sudo getenforce (SELinux) or check AppArmor profiles in /etc/apparmor.d/

Frequently asked questions

What does "channel 0: open failed: administratively prohibited: open failed" mean?
When you attempt to use SSH features like local port forwarding (-L), remote port forwarding (-R), SFTP/SCP, or X11 forwarding, SSH must open a channel on the remote server to handle the operation. This error message indicates the SSH server has accepted your authentication but explicitly rejects the channel open request because it is administratively prohibited. This typically happens due to sshd configuration restrictions that limit which operations are allowed, which users can use certain features, or which specific ports/hosts can be accessed through forwarding.
How do I fix "channel 0: open failed: administratively prohibited: open failed"?
This error occurs when the SSH server (sshd) denies a channel opening request for port forwarding, tunneling, or subsystem operations. It means the server is configured to administratively prohibit the requested operation, even though the authentication succeeded.
What causes "channel 0: open failed: administratively prohibited: open failed"?
AllowTcpForwarding is set to 'no' in /etc/ssh/sshd_config on the server PermitOpen is restricted to specific destinations and your target is not in the list PermitTunnel is set to 'no', preventing tunnel requests
Is the "channel 0: open failed: administratively prohibited: open failed" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading