diff --git a/ChangeLog b/ChangeLog
index ee5276502..40cf07d41 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -12,6 +12,9 @@
    - markus@cvs.openbsd.org 2003/06/29 12:44:38
      [sshconnect.c]
      memset 0, not \0; andrushock@korovino.net
+   - markus@cvs.openbsd.org 2003/07/02 12:56:34
+     [channels.c]
+     deny dynamic forwarding with -R for v1, too; ok djm@
 
 20030630
  - (djm) Search for support functions necessary to build our 
@@ -632,4 +635,4 @@
  - Fix sshd BindAddress and -b options for systems using fake-getaddrinfo.
    Report from murple@murple.net, diagnosis from dtucker@zip.com.au
 
-$Id: ChangeLog,v 1.2838 2003/07/03 03:48:04 dtucker Exp $
+$Id: ChangeLog,v 1.2839 2003/07/03 03:52:04 dtucker Exp $
diff --git a/channels.c b/channels.c
index 04ef6575c..ce07db5c0 100644
--- a/channels.c
+++ b/channels.c
@@ -39,7 +39,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: channels.c,v 1.191 2003/06/24 08:23:46 markus Exp $");
+RCSID("$OpenBSD: channels.c,v 1.192 2003/07/02 12:56:34 markus Exp $");
 
 #include "ssh.h"
 #include "ssh1.h"
@@ -2201,9 +2201,13 @@ channel_input_port_forward_request(int is_root, int gateway_ports)
 	 * privileged port.
 	 */
 	if (port < IPPORT_RESERVED && !is_root)
-		packet_disconnect("Requested forwarding of port %d but user is not root.",
-				  port);
+		packet_disconnect(
+		    "Requested forwarding of port %d but user is not root.",
+		    port);
+	if (host_port == 0)
+		packet_disconnect("Dynamic forwarding denied.");
 #endif
+
 	/* Initiate forwarding */
 	channel_setup_local_fwd_listener(port, hostname, host_port, gateway_ports);