Symptoms

Native-client connections via PrivX Extender fail with  Error "Administratively prohibited"

Causes and Solutions

This section describes the possible causes and solutions of the symptom.

PrivX Configuration

Your PrivX deployment may not be configured for proxying native-client connections. Verify your PrivX settings and adjust as necessary:

- In  the Extender configuration (/opt/privx/etc/extender-config.toml on your PrivX Extenders), privx_ssh_proxy_enabled  = true 

- In the Authorizer configuration (/opt/privx/etc/authorizer.toml on PrivX servers), the setting ssh_default_extensions includes the keywords permit-port-forwarding and permit-X11-forwarding

- In the SSH-proxy configuration (/opt/privx/etc/ssh-proxy.toml on PrivX servers), forwarder_enabled = true

- If connecting to loopback addresses (localhost, 127.0.01, ::1), allow_connect_to_loopback = true and allow_connect_to_local_addresses = true in the SSH-proxy configuration.

- If connecting to local FQDN or IP (PrivxX front-end FQDNs and/or IPs) then only the allow_connect_to_local_address must be set to true.

- If connecting to other addresses, make sure the target address is not listed in the target_blacklist setting in SSH-proxy configurations.

- The target-host IP address must belong in the allowed Subnets of the Extender. These can be verified on the PrivX GUI→Settings→Deployment→Deploy VPC/VPN extenders page, under the Extender configuration.

- Session recording is disabled on the target host. You can check this in the host settings, on the PrivX GUI→Settings→Hosts page.

Other Causes

Also ensure the following:

- The ssh-proxy can establish connections to connection manager.

- Your PrivX license is valid.