I've been doing tunneling of my web traffic for years now using the PuTTY -> Ubuntu server -> internet method for a while. (BTW, the article linked is not the article I specifically used WAY back in the day but the concepts are the same.)

One thing I added to this set up was chroot jail using the article linked. The exception I made was, of course, setting AllowTcpForwarding to yes

However, after upgrading to 16.04, the proxy stopped working...sort of. Sites that are resolved in /etc/hosts work fine but sites that weren't would kind of get blocked. When I inspected the PuTTY event log, I got the following error:

2016-09-02 12:48:45 Opening connection to en.wikipedia.org:443 for forwarding from
2016-09-02 12:48:45 Forwarded connection refused by server: Administratively prohibited [open failed]

Everything works correctly if I log in as a non-chjailed user. This leads me to believe that the chjailed user cannot resolve DNS queries, which wasn't the case before. My guess is that the upgraded sshd daemon stops DNS queries now. I'm not sure how to confirm this for sure but when I try to visit wikipedia via it's IP address, I can connect.

Some unique things in my set up: the same server I'm ssh'ing into has dnsmasq set up to do DNS caching among other things. dnsmasq works correctly as expected.

What has changed in the new sshd that would prevent DNS resolution? What libraries do I need to add to re-enable it for the chjailed user?


  • What version did you upgrade from? I honestly know nothing about chrooted environments, but I wonder if the change to resolvconf (which happened around 12.04 iirc) is significant? In particular, that /etc/resolv.conf is a symlink to /run/resolvconf/resolv.conf - can your chroot jail handle that? – steeldriver Sep 2 '16 at 17:47
  • I upgraded from 14.04. It looks like I never had a chjail version of the resolv.conf file. I'll copy that and see if that helps things. – scuba_mike Sep 3 '16 at 16:17
  • Sorry for the delayed reply. Copying /etc/resolv.conf did not resolve the issue. – scuba_mike Sep 7 '16 at 11:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.