Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Due to security reasons, I have created a user on my remote VPS only to use it for SSH tunneling. My local PC goes in hands of many others which scares me because I need to leave that SSH session open. So, I want to lock this user (on server) so that others couldn't do anything other than SSH tunneling (even if password gets compromised). With this user, I only want to login (with password) & do SSH tunneling.. nothing more!
Can you please help?

share|improve this question
@ChrisS oh sorry.. I was on my friend's PC. By mistake, I used the browser in which he logged in. So, you might have encountered same flag message from two accounts. – user148331 Feb 17 '12 at 17:33

Presumably, you use an SSH key to authenticate as that user.

In the .ssh/authorized_keys you can set options about what things that user can do. For example you could set the no-pty, no-X11-forwarding options to prevent the user from getting a shell or doing any X11 forwarding. See the sshd man page for a full list of options.

If you are not using key-based authentication, and your server is running a fairly recent version of OpenSSH, then use the Match user option combined with the options to block access, and force a command that does nothing. See man sshd_config.

Match user username
    AllowTcpForwarding yes
    X11Forwarding no
    ForceCommand /bin/cat
share|improve this answer
By login, I meant login with password. SSH key based authentication doesn't work with SSH Tunnel app of Android. – user148331 Feb 15 '12 at 23:51
Really? What a less than useful application. – Zoredache Feb 15 '12 at 23:53
Instead of /bin/cat, you want – wfaulk Feb 16 '12 at 0:12

You could set up the initial SSH session/tunnel without RSA keys and the -L (bind forwarded address to local address) and -N command (do not execute any commands) ie:

ssh -L local port:webaddress:port -N

so in your case, since you're forwarding SSH, it might look like...

ssh -L 22:webaddress:22 -N

This should set you up with the forward, without setting up a session.

some light watching and reading on this.

share|improve this answer
But, its not server-side solution. If my password gets compromised, it can't help. Notice, I have added dedicated user for this task. – user148331 Feb 16 '12 at 0:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.