Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to configure ssh (on linux) to allow access for tunneling only? Ie user can setup tunnels but cannot get a shell/access files?

share|improve this question
up vote 30 down vote accepted

Yes, just use /bin/false as shell and instruct the user to start the tunneling SSH process without executing any remote command (i.e. the -N flag for OpenSSH):

ssh -N -L 1234:target-host:5678 ssh-host
share|improve this answer

In the user's .ssh/authorized_keys file, put something like the following:

permitopen="",permitopen="",no-pty ssh-rsa AAAAB3N...

So, basically, you the controls would be in front of the user's ssh public key separated by a space. In the example, connections using the specific public key will be allowed to do SSH port forwarding only to's MySQL server and's web server, and will not be assigned a shell (no-pty). You're specifically asking about the "no-pty" option, but the others may also be useful if the user is only supposed to tunnel to specific servers.

Look at the man page for sshd for more options for the authorized_keys file.

Note that the user's experience may look a little odd: when they ssh in, it will look like the session is hanging (as they are not getting a pty). That's OK. If the user has specified port forwarding with, for example, "-L3306:", the port forwarding will still be in effect.

In any case, give it a try.

share|improve this answer
This is dangerous advice; no-pty doesn't prevent shell access, it just doesn't give the shell a pty. It doesn't display the prompt (ie. "appears to hang"), but you can still give commands just fine. You need the command="..." option in .ssh/authorized_keys if you want to restrict shell access from there. – Aleksi Torhamo Jan 1 '15 at 19:58

Assign a shell that doesn't let the user log in.


echo "No interactive login available."
sleep 60
exit 0

would prevent them from getting a shell prompt, and give them a time-out of 60 seconds - if there's no connection active for 60 seconds then it will exit and thereby disconnect them completely (increase the number according to requirements).

They can't execute a remote command, either, because that shell won't let them.

share|improve this answer
Most linux installs already come with something for that. /sbin/nologin, or /bin/false or similar. – Rory Aug 20 '09 at 11:27
What would Ctrl-C do in the above example? – Arjan Aug 20 '09 at 12:00
Arjan: Since the script is used as the shell, Ctrl-C would have the same effect as "logout" on a normal one. – grawity Aug 20 '09 at 12:47
I actually like earl's response, with the "-N" option, but if you want to give your user a helpful, friendly, informative message - and stop them leaving SSH connections all over the place - then a custom script is nice and clear about what it's doing. – jrg Aug 20 '09 at 17:06

Give the user a shell that only allows them to log out such as /bin/

read -n 1 -p "Press any key to exit" key

This way he can stay logged in as long as he wants, with tunnels active, but not run any commands. Ctrl-c closes the connection.

share|improve this answer
I think that at least in theory, the user will be able to hit CTRL+C at the right moment (between lines 1 and 2) and end up with a full bash shell. – andreas-h Jan 21 '13 at 9:03

My solution is to provide the user who only may be tunneling, without an interactive shell, to set that shell in /etc/passwd to /usr/bin/tunnel_shell.

Just create the executable file /usr/bin/tunnel_shell with an infinite loop.

Additionally make use of the AllowGroups and Match Group option.

Fully explained here:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.