2

I have a server setup up with Ubuntu 12.10. Got everything working nicely except for one thing: SSH port forwarding.

I use the following command to forward some VNC server to my PC:

ssh -L 5900:node:5900 adminuser@server

That works very well.

However, this is not true for other users:

ssh -L 5900:node:5900 someotheruser@server

This user is able to connect to the server (can log in and do something), but the port is not forwarded, i.e. gvncviewer localhost is not finishing (says Connected to server but never asks for the password).

What do I have to do in order to allow forwarding for the other (or selected) users as well?

Edit: Using ssh -vv ... I got the following messages when calling gvncviewer localhost and having connected using the adminuser:

debug1: Connection to port 5900 forwarding to 10.100.0.8 port 5900 requested.
debug2: fd 9 setting TCP_NODELAY
debug2: fd 9 setting O_NONBLOCK
debug1: channel 3: new [direct-tcpip]
debug2: channel 3: open confirm rwindow 2097152 rmax 32768
... -----> It works

For the someotheruser I get:

debug1: Connection to port 5900 forwarding to 10.100.0.8 port 5900 requested.
debug2: fd 9 setting TCP_NODELAY
debug2: fd 9 setting O_NONBLOCK
debug1: channel 3: new [direct-tcpip]
-----> Here it hangs for a long time...
channel 3: open failed: connect failed: Connection timed out
debug2: channel 3: zombie
debug2: channel 3: garbage collecting
debug1: channel 3: free: direct-tcpip: listening port 5900 for 10.100.0.8 port 5900, connect from 127.0.0.1 port 39009, nchannels 4

Apparently the problem is caused by the VNC server and not by ssh.

  • Try to use ssh -v to see if it can help to show the problem. Moreover, ports are global, so I imagine that you are not trying to run the second command while the first one is running (it is not clear in the question). – Rmano Feb 18 '14 at 19:23
  • I'm trying one or the other command, not both. ssh -v gives me OpenSSH_5.9p1 Debian-5ubuntu1.1, OpenSSL 1.0.1 14 Mar 2012 on the server and OpenSSH_6.2p2 Ubuntu-6ubuntu0.1, OpenSSL 1.0.1e 11 Feb 2013 on my computer – MrD Feb 18 '14 at 20:25
  • Sorry I was not clear --- if you use ssh -v -L 5900:node:5900 someotheruser@server the command will be verbose and it will comment what is happening --- so it is easier to detect the problem. You can use also -vv and -vvv to have more debug information. – Rmano Feb 18 '14 at 20:29
  • Added the requested information in the question. – MrD Feb 18 '14 at 20:43
  • It is as the user can't connect (locally) to the port 5900. Try to see if you can connect locally (ssh without the redirection, and in the user shell try telnet 10.100.0.8 5900). Be prepared to kill the telnet from another ssh session, it may hang even if it works (if it works it should say something like RFB 003.007 or similar). Check that the VNC server is run by the same user you are trying to connect with. – Rmano Feb 18 '14 at 20:51
1

I try to compose an answer so that we can mark this question solved.

To check the connection, run ssh using one or more -v options, like in:

ssh -v ... 

or

ssh -vvv ...

Checking the log, it is as the user can't connect (locally) to the port 5900.

Try to see if you can connect locally:

 ssh someotheruser@server 

and when you have the user's shell on the server try

 telnet 10.100.0.8 5900 

Be prepared to kill the telnet from another ssh session, it may hang even if it works (if it works it should say something like

Trying 10.100.0.8...
Connected to localhost.
Escape character is '^]'.
RFB 003.007

If it does not connect, the problem is not in ssh port forwarding, is that the VNC server is not accepting connections from the user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.