Allowing some forms of ssh forwarding / tuneling, but not others
You can edit the sshd config at
- enable reverse forwarding (i.e.
-R is allowed, which is what you want)
- but disable local forwarding (i.e.
-L is not allowed, which is what you want)
You can do this globally by setting in your
or you can do it on a per-use basis with:
# disable Tcp Forwarding for all by default
# allow remote Tcp forwarding for user some_username
Match User some_username
Note / Edit: locking the user from doing anything else
I did not mention this initially, as it is already mentioned in the initial question, but the user should be denied logging, so that they cannot set up their own forwarder.
You can do this by setting the default shell for the user to
/usr/sbin/nologin in the
etc/passwd file for example. The user will have to use
ssh -NR remote_port:localhost:local_port some_username@server_address
to set up the reverse tunnel, where the
-N command means that this is only for port forwarding, not for attempting to execute command / get a shell.
Looks like (but I have not tried it myself) this can also be done directly in
/etc/sshd_config by adding something like (you could send to another / possible custom shell script to display something or do any other action):
Match User some_user
or possibly (I have not tested if
-NR still works then) adding something like this instead if you want to show a banner:
Match User guest