I'm running a Debian Linux. I'd like to have a user account that is able to connect via SSH for TCP-forwarding only, without a command prompt.

e.g the following would work (from a remote computer):

ssh -D1234 user@myhost

but no command prompt would appear.

Using a shell like /bin/false or /sbin/nologin is too restrictive as it doesn't even allow the user to log in. A shell that only allows the "exit" or Ctrl+D commands would do the job.

I know that something similar is possible to allow only SFTP, but I can't find the equivalent for TCP forwarding.


  • 1
    you can add "no-pty" to in authorized_keys of the user. Or you can use "match user" in ssh_config and set force_command to something else look here: stackoverflow.com/questions/8021/… Jun 30, 2013 at 16:43
  • See: askubuntu.com/questions/48129/…
    – Zoredache
    Jul 1, 2013 at 3:07
  • @TimHaegele no-pty won't prevent the user from executing commands non-interactively, though. Jul 1, 2013 at 4:14
  • BTW, have you considered just setting up a VPN? That seems to be what you are really looking for.
    – Zoredache
    Jul 1, 2013 at 5:13

2 Answers 2


It sounds like you're looking for the -N option:

-N      Do not execute a remote command.  This is useful 
        for just forwarding ports (protocol version 2 only).

Like so:

ssh -D 8080 -N foo@bar.com

Also of some interest might be the -f option:

 -f      Requests ssh to go to background just before command execution.  
         This is useful if ssh is going to ask for passwords or passphrases, 
         but the user wants it in the background.  This implies -n. 
         The recommended way to start X11 programs at a remote site is 
         with something like ssh -f host xterm.

If you want to restrict what inbound connections can:

  • Set up a custom command in your authorized_keys file (assuming you're using ssh keys)
  • Change your user's shell

What command/shell you use depends on what you want to allow. For example:

  • /bin/cat will hold the connection open but do absolutely nothing
  • rssh will allow you to customize what actions are available
  • A chroot jailed shell will provide similar customizability
  • bash can be run in restricted mode (rbash) which only allows you to run commands in your configured PATH. It's not foolproof, but it's worth more than nothing.
  • The -N and -f flags would be specified by the client, if the client voluntarily chooses not to execute anything. The question is, how can the server's sysadmin prevent the user from executing anything? Jul 1, 2013 at 4:13
  • @200_success edited to answer
    – tylerl
    Jul 1, 2013 at 4:34
  • Setting the user's terminal as /bin/false and requiring the -N option does the job. Thanks @tylerl!
    – Raphael K
    Jul 1, 2013 at 19:58

I'm not sure if this will do. I have a cluster where I want people to work on front-end but that they are not allowed on computational nodes. All people have accounts on all computers, however, the nodes have a following lines in /etc/profile:

if test "$TERM" != "linux" && test "$USER" != "root" ;then
  echo ""
  echo -e "\\033[0;34m=======================================================================\\033[0;39m"
  echo ""
  echo -e "\\033[0;31m         Login to this host is allowed for administrator only.\\033[0;39m"
  echo -e "            Please use \\033[0;34mqueue\\033[0;39m to submit your jobs instead"
  echo -e "    or \\033[0;34m132.187.71.6\\033[0;39m or  \\033[0;34m132.187.71.7\\033[0;39m to login into cluster front-end."
  echo ""
  echo -e "\\033[0;34m=======================================================================\\033[0;39m"
  echo ""

The part with $TERM checks if login was direct (i.e. with ssh) or via queueing system. The last one is allowed. If you want a specific user to be allowed to login you can add to the if-statment && test "$USER" != "someuser"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.