So I've added a public key to authorized_keys. How can I limit it so that it may forward ports but it may not have a shell?


You have to add no-pty,command="/bin/false" keyword before your key so it will look like this:

no-pty,command="/bin/false" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABBACzbcwCZNaN3HhHmpnaVrfZlNJ0HhPnOqEj
+1Mn4xXZKiZhBh1DX youruser@yourhome

(This is all in a single line, I added the line breaks for readability).

  • 5
    That restricts the ability to have a remote login, it does not prevent remote execution of commands. Src: marc.info/?l=openssh-unix-dev&m=111143581515782&w=2 – mctylr Apr 13 '10 at 19:52
  • 1
    @mctylr: that was not part of the question. But you are right maybe the OP was not aware of that, so I added that to the answer. (+1) – cstamas Apr 16 '10 at 8:42
  • 1
    Also worth noting is that you need to use 'ssh -N' to keep the tunnel up when there is no shell at the remote end. – Mike Pountney Dec 5 '11 at 14:05

man sshd

Section AUTHORIZED_KEYS FILE FORMAT. You can restrict what users can port forward to simply by adding the ports and hosts you want to allow, like


Also you can restrict where do the user connect from, which commands can execute, etc.


I would look at using scponly, I suspect it can be used for port forwarding rather than scp/sftp-only access. It is intended to restrict the user from logging in or executing commands via ssh.

The other factor you may need to, or want to, use sshd in a chroot'ed environment, here are some instructions on setting up sftp using chroot. You should be able to adapt them fairly easily.

I hope that helps you find your solution.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.