Skip to main content
protocols.pageprotocols.page
1

SSH_OPEN_ADMINISTRATIVELY_PROHIBITED

Channel FailureRFC 4254 §5.1

SSH_OPEN_ADMINISTRATIVELY_PROHIBITED (1) is sent in SSH_MSG_CHANNEL_OPEN_FAILURE when the server refuses to open a channel due to administrative policy. The channel type or operation is not permitted by server configuration. Common when port forwarding or X11 forwarding is disabled in sshd_config.

Code

1

Category

Channel Failure

Standard

RFC 4254 §5.1

Description

Channel open failures with code 1 are the SSH connection layer's equivalent of HTTP 403 Forbidden. The SSH transport and authentication succeeded, but the specific channel operation is not permitted by the server's administrative policy.

The most common triggers: requesting a direct-tcpip channel (local port forwarding) when AllowTcpForwarding is set to no in sshd_config, requesting an x11 channel when X11Forwarding is no, or requesting a direct-streamlocal channel (Unix socket forwarding) when it is disabled.

This code also appears in restricted SSH environments where the authorized_keys file uses the no-port-forwarding option for a specific key, preventing that key from opening forwarding channels even if the server globally permits it.

Common Causes

  • –AllowTcpForwarding no in sshd_config blocking port forwarding channels
  • –X11Forwarding no blocking x11 channel requests
  • –authorized_keys no-port-forwarding restriction for this key
  • –SSH server running in restricted mode (e.g., rssh or git-shell)
  • –PermitOpen restriction blocking the requested forwarding destination
RFC 4254 – SSH specification →