We have an application that uses SSH to connect to a server : the application's network traffic (database, some custom TCP protocols, etc...) is tunneled through a SSH connection.
We use a key pair and an unprivileged account on the server, but the users still can use their key to login to the server, or do whatever port redirection they want.
Is there a way to configure the SSH server to allow only some tunnels (restricted on the tunnels' end address and port), and disable shell access ? (we use OpenSSH)
I came across this article, it seems like removing shell access is not enough. Changed title and description accordingly.