SSH port forwarding: “Privileged ports can only be forwarded by root” error

opensshport-forwardingsshsudo

I wanted to forward my local 8080 port to the 80 port of the server I want to log in via SSH, so I did:

ssh -L 80:127.0.0.1:8080 -N -f myserver

But I get the error:

Privileged ports can only be forwarded by root.

I can execute sudo commands when logged in that server, but how can I do it for the purposes of port forwarding? (Note: appending sudo at the beginning of this command doesn't help, because the port 80 is not the port I want to use in localhost, but the port I want to target.)

Best Answer

You probably want

ssh -L 8080:127.0.0.1:80 -N -f myserver

Local port comes first. (That's not my political stance!)

Related Solutions

Ssh – unable to connect to forwarded port over ssh

If you do not specify the hostname psql assumes domain socket connections. As per the man page:

If you omit the host name, psql will connect via a Unix-domain socket to a server on the local host, or via TCP/IP to localhost on machines that don't have Unix-domain sockets.

Try adding -h localhost to the psql command line.

As to the Oracle error, I would guess because of the following (oracle is much harder to diagnose):

The ORA-12537 error sometimes relates configuration issues in the sqlnet.ora, protocol.ora and listener.ora files.  Verify that you service names match between your listener and remote client connect strings.

So your connect string including localhost is being rejected by oracle.

update

If that is a local tnsnames.ora, have you tried sqlplus W_USER@PROD2 instead? (it will prompt for a password if required). You may have to set the environment variable TNS_ADMIN to the location of where tnsnames.ora resides.

Ssh – What does port forwarding mean in “SSH port forwarding”

1 - general case

Suppose you have two server in a company network.

From local server "L1" you have access to a remote server "R1" via ssh on port 22.

The server R1 host a web service, but firewall/NAT/whatever block direct access to port 80.
"R1" can't access "L1" directly due to NAT issue.

from L1 you connect using (same user on both host)

ssh -L 10080:localhost:80 -R 10022:localhost:22 R1

now,

-L 10080:localhost:80 local browsing on 10080 will be forward to distant host (R1), localhost (e.g. distant 127.0.0.1) on port 80, thus you could browse distant host (R1), while blocked by firewall/NAT.
-R 10022:localhost:22 remote use of port 10022 will be forwarded to localhost (L1) port 22, you can initiate scp/ssh from remote to localhost. (using scp -P 10022 file localhost: (note upper -P ) )

This is actually a command line I use from an Ubuntu (14.04) laptop to go to production server (I can firefox to localhost:10080 and use scp from server to localhost:10022 to bring back file )

now your IP are

192.168.1.1 L1
172.17.17.1 R1

you use

ssh -L 10080:172.17.17.3:80 -R 10022:192.168.1.5:22 \
     -L 192.168.1.9:8888:172.17.17.9:9999 R1

now

distant access to port 10022 (any IP) will be forwarded to local 192.168.1.5 ssh/scp.
local access to port 10080 (any IP) will be forwarded to distant host 172.17.17.3 port 80.
local access to port 8888 from 192.168.1.9 will be forwarded to port 9999 on 172.17.17.9 (192.168.1.9 is a local address in L1, using alias mecanism, this is not a firewall rule).

those setting can be used on putty/bitwise client

Ask Ubuntu question

what about

 -R 8000:localhost:80

this read as

-R remote
8000 port 8000 (remote port 8000 ... )
localhost (remote port 8000 goest to localhost .. )
80 ( remote port 8000 goes to localhost port 80 )