Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What I am trying to do is have a user that can port forward, but only to a certain host and port.

I've disabled TCP forwarding over ssh for that user, and according to the manpage for sshd_config I should still be able to port forward with other tools, which I cannot figure out how to do.

EDIT: Found a better solution, using match and PermitOpen in the sshd_config

share|improve this question

ssh -L or ssh -R, depends what do you need :)

share|improve this answer
TCP forwarding is disabled on the sshd, and according to the manpage for sshd_config you can still use external tcp forwarders, the end result of this will be that this user will only be capable of connecting to one certain predefined host and port combination. – Trevor Dorl Jul 10 '12 at 12:24
I guess this means, that en-/decapsuplation process can be attached to the ssh virtual terminal like the tar-pipe: ''tar -czf - | ssh $host "tar -xzf -"''. Instead of tarring, that application can open sockets and do stuff... – Michuelnik Jul 10 '12 at 12:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.