How to fix open failed: administratively prohibited: open failed in SSH

SSHINTERMEDIATEMEDIUMUpdated Jan 4, 2026· 482 views

SSH channel open requests are rejected due to server-side policy restrictions. This commonly occurs when port forwarding is disabled in sshd_config or when tunneling operations are restricted for security reasons.

Quick fix

Fixes open failed: administratively prohibited: open failed

sudo grep -E 'AllowTcpForwarding|PermitTunnel|DisableForwarding' /etc/ssh/sshd_config
  1. Check current SSH config on the target server
  2. Enable AllowTcpForwarding in sshd_config
  3. Enable PermitTunnel if using VPN-style connections
  4. Check for restrictive Match blocks
ssh — error
sudo grep -E 'AllowTcpForwarding|PermitTunnel|DisableForwarding' /etc/ssh/sshd_config
open failed: administratively prohibited: open failed

What this error means

This error means the SSH server (sshd) has explicitly denied your request to open a new channel. SSH uses channels for various operations including port forwarding (LocalForward, RemoteForward), subsystem requests, and shell sessions. When the server responds with 'administratively prohibited', it indicates that sshd_config has been configured to explicitly block this type of channel operation for security reasons. The error is intentional and enforced at the daemon level, not a temporary network issue.

Typical symptoms

  • SSH tunneling with -L (local forward) or -R (remote forward) flags fails immediately
  • VS Code Remote SSH extensions fail to connect
  • Port forwarding commands return error before any connection attempt
  • Subsystem requests fail (e.g., SFTP operations)
  • SSH proxy jump/bastion host configurations fail with this error
  • Automated tools using SSH tunneling (Terraform, Ansible over SSH) fail

Common causes

  1. AllowTcpForwarding is set to 'no' in /etc/ssh/sshd_config on the target server
  2. PermitTunnel is set to 'no' in /etc/ssh/sshd_config (default in some hardened systems)
  3. DisableForwarding is set to 'yes' in sshd_config Match blocks that apply to your user
  4. SSH Match blocks in sshd_config restrict specific users or groups from channel operations
  5. MaxStartups limit on concurrent connections has been reached on the SSH daemon
  6. SELinux or AppArmor policies on the server block forwarding operations silently
  7. The SSH server is configured with restrictive security policies (corporate/cloud-hardened systems)

How to fix "open failed: administratively prohibited: open failed"

1Check current SSH config on the target server

Connect to the SSH server and inspect the current sshd_config settings:

bash
sudo grep -E 'AllowTcpForwarding|PermitTunnel|DisableForwarding' /etc/ssh/sshd_config

If these lines are absent, the defaults apply (which may be 'no' on hardened systems). Note the current values before making changes.

2Enable AllowTcpForwarding in sshd_config

Edit /etc/ssh/sshd_config and add or modify the AllowTcpForwarding setting:

bash
sudo nano /etc/ssh/sshd_config

Find or add this line:

bash
AllowTcpForwarding yes

This enables both local (-L) and remote (-R) port forwarding. Save and exit (Ctrl+X, then Y, then Enter in nano).

3Enable PermitTunnel if using VPN-style connections

If you need tun/tap device tunneling (not just port forwarding), also add:

bash
PermitTunnel yes

This enables VPN-style connections using device forwarding. If you only need port forwarding, this is optional.

4Check for restrictive Match blocks

Inspect the file for Match blocks that might override global settings:

bash
sudo grep -n 'Match' /etc/ssh/sshd_config

Look for blocks like:

bash
Match User someuser
    DisableForwarding yes

If Match blocks disable forwarding for your user, either remove those lines or add your user/group to a block that allows forwarding.

5Restart the SSH daemon

Apply the configuration changes by restarting sshd:

bash
sudo systemctl restart sshd

On BSD systems, use:

bash
sudo service sshd restart

Or on older systems:

bash
sudo /etc/init.d/sshd restart
6Test the SSH connection with forwarding

Verify the fix by attempting a port forward operation:

bash
ssh -v -L 9999:127.0.0.1:3306 user@remotehost

The -v flag adds verbose output. You should see successful channel open messages instead of 'administratively prohibited'. For tunnels, leave the connection open and test from another terminal.

Advanced notes

In corporate or hardened environments (cloud instances, containers), administrators may intentionally disable forwarding for security. If you cannot modify sshd_config, work with your system administrator to request the appropriate relaxed permissions. Some organizations allow forwarding only from specific IP ranges or for specific users via Match blocks. When SSH fails with 'administratively prohibited', server-side logs (typically /var/log/auth.log or /var/log/secure) show the exact policy that rejected the request, which can help diagnose Match block issues. Be aware that AllowTcpForwarding affects both local and remote forwarding equally—you cannot enable one without the other. If you need fine-grained control, use PermitOpen directives to restrict forwarding to specific hosts/ports. Some tools like VS Code Remote SSH may require additional troubleshooting: killing existing vscode processes or restarting the server may be necessary if sshd cached the old configuration.

Frequently asked questions

What does "open failed: administratively prohibited: open failed" mean?
This error means the SSH server (sshd) has explicitly denied your request to open a new channel. SSH uses channels for various operations including port forwarding (LocalForward, RemoteForward), subsystem requests, and shell sessions. When the server responds with 'administratively prohibited', it indicates that sshd_config has been configured to explicitly block this type of channel operation for security reasons.
How do I fix "open failed: administratively prohibited: open failed"?
SSH channel open requests are rejected due to server-side policy restrictions. This commonly occurs when port forwarding is disabled in sshd_config or when tunneling operations are restricted for security reasons.
What causes "open failed: administratively prohibited: open failed"?
AllowTcpForwarding is set to 'no' in /etc/ssh/sshd_config on the target server PermitTunnel is set to 'no' in /etc/ssh/sshd_config (default in some hardened systems) DisableForwarding is set to 'yes' in sshd_config Match blocks that apply to your user
Is the "open failed: administratively prohibited: open failed" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading