Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On my Debian system, I'd like to create a user that is only allowed to do a Reverse Port Forward from their machine to my server, but I'm not sure how to create a limited user specifically for this purpose.

For example, we'll call my server 'Sam' and my laptop 'Luke'. I'd like a user on Luke to be able to execute a reverse port forward ssh command to Sam, so that port 4321 on Sam is tunneled to port 4321 on Luke. For example:

ssh -fnR 4321:localhost:4321 -l limitedUser Sam

How can I create a user on Sam that is only allowed to execute this command?

share|improve this question
up vote 2 down vote accepted

The document I always look to on complicated SSH stuff is this one on doing passphraseless SSH right.

The important things are to restrict with command= on .ssh/authorized_keys and to set their shell to /bin/nologin. I'm not sure off the top of my head what the name of the reverse forward command would be. You might not even need one, in which case just make the command nologin or logout or something.

share|improve this answer
that's going to help a lot. I didn't realize the authorized_keys file format had so many options. Thanks. – drfloob Apr 2 '10 at 23:45

To be more precise just add permitopen="host:port" ssh-rsa yourrsakey. That will restrict port forwarding to one host:port only

share|improve this answer
This restricts local port forwarding. The OP is asking about remote port forwarding. – bstpierre Nov 17 '10 at 2:06

You might also be interested in the Match keyword in sshd_config:

It might be better if you have lots of users with similar privileges, and safer in some contexts, since /etc/sshd_config is only root-writable, yet ~/.ssh/ is not ALWAYS read-only for users.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.