Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to be able to offer SSH accounts on my Linux server for people to be able to use for SSH tunnelling. All accounts will be locked down with no interactive shell, for tunnelling / port forwarding purposes only. My problem is that I don't want them to be able to access services that are bound to localhost only by doing port forwards like the following:

ssh account@server -L 9999: & telnet localhost 9999

This would give them access to the default MySQL database port. How can I stop this?

I see options in the configuration file for OpenSSH to allow specific ports/hosts, but not to block them. Any help would be greatly appreciated!

share|improve this question

I haven't tried it myself, but the --uid-owner and --gid-owner options for iptables rules appears to let you restrict connections based on UID and GID. In other words, specific users can be prevented from making outbound connections on a given interface.

So maybe something like this (not tested), to block all access to loopback:

iptables -A OUTPUT -o lo -m owner --uid-owner {USERNAME} -j REJECT

... or if your locked-down accounts are all in the same group:

iptables -A OUTPUT -o lo -m owner --gid-owner {GROUPNAME} -j REJECT

If you need something more granular, this nixCraft post has an example of how to allow some ports, but not others.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.