So I've added a public key to
authorized_keys. How can I limit it so that it may forward ports but it may not have a shell?
You have to add
no-pty,command="/bin/false" keyword before your key so it will look like this:
no-pty,command="/bin/false" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABBACzbcwCZNaN3HhHmpnaVrfZlNJ0HhPnOqEj k2llms1OOPnEXetIlZuJw0UXbyMbhQbBl/E2wxXvXvF+jyLRR5yN6kBydM4LhjC0ej0PcH839vXd uwJpDFjPw3s7r0VOhU1WRyk6Da6rX6shzabhQioIm3MHCjNOdywPb0k1cTj4yOxoOCOqGjmXK0 xxzTd+ZjTJqQGWzZ+8L8cVtKmU8kspYlCdhGWSv0Den36OsScnWTBn8A3X3lVJB5NkEm BM1yKX4F6BhhD317VensEUu031PtFULeSF97IxDPmK36OFz9TPSf4d8Hp3BqtysqUlbWfEhYdHXj +1Mn4xXZKiZhBh1DX youruser@yourhome
(This is all in a single line, I added the line breaks for readability).
I would look at using scponly, I suspect it can be used for port forwarding rather than scp/sftp-only access. It is intended to restrict the user from logging in or executing commands via ssh.
I hope that helps you find your solution.