Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I've added a public key to authorized_keys. How can I limit it so that it may forward ports but it may not have a shell?

share|improve this question
up vote 10 down vote accepted

You have to put a no-pty keyword before your key so it will look like this:

no-pty ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABBACzbcwCZNaN3HhHmpnaVrfZlNJ0HhPnOqEj
+1Mn4xXZKiZhBh1DX youruser@yourhome

(This is all in a single line, I added the line breaks for readability).

UPDATE: if you want to prevent remote command execution you have to add: command="/bin/false"

no-pty,command="/bin/false" ssh-rsa ...
share|improve this answer
That restricts the ability to have a remote login, it does not prevent remote execution of commands. Src: – mctylr Apr 13 '10 at 19:52
@mctylr: that was not part of the question. But you are right maybe the OP was not aware of that, so I added that to the answer. (+1) – cstamas Apr 16 '10 at 8:42
Also worth noting is that you need to use 'ssh -N' to keep the tunnel up when there is no shell at the remote end. – Mike Pountney Dec 5 '11 at 14:05

man sshd

Section AUTHORIZED_KEYS FILE FORMAT. You can restrict what users can port forward to simply by adding the ports and hosts you want to allow, like


Also you can restrict where do the user connect from, which commands can execute, etc.

share|improve this answer

I would look at using scponly, I suspect it can be used for port forwarding rather than scp/sftp-only access. It is intended to restrict the user from logging in or executing commands via ssh.

The other factor you may need to, or want to, use sshd in a chroot'ed environment, here are some instructions on setting up sftp using chroot. You should be able to adapt them fairly easily.

I hope that helps you find your solution.

share|improve this answer
scponly seems to have moved to . Your link gives a 404. :( – Bill Weiss Jan 13 '13 at 17:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.