Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to restrict users who connect via ssh on a server (with OpenSSH) to do local port forwarding on certain ports only.

I've found that setting the permitopen="address:port" option in their ~/.ssh/authorized_keys files do what I expect.

However it is not very convenient since I have to edit all existing authorized_keys files and if, in the future, I want to allow more ports, change the allowed ports,... I will have to edit them all again.

Is something similar achievable for all users in a group i.e. "allow local port forwarding only on address:port if the user belongs to this group"?


EDIT> it seems that the sshd_config file has a feature which allows this: Match. I can match an user or a group and apply some custom configs for them among which PermitOpen which I must have skipped while reading the man page for the first time.

share|improve this question
Is using a script to do the editing of ~${username}/.ssh/authorized_keys an option ? – Karolos Feb 10 '12 at 15:54
I would prefer to do it otherwise, but yes it is definitely the option I will choose if nothing else is possible :) I will have to improve my bash skills though. – ixM Feb 10 '12 at 17:51
up vote 0 down vote accepted

You can specify conditional blocks in /etc/ssh/sshd_config and apply directives like PermitOpen to restrict what users can do. The following would allow members of the restricted group to only tunnel connections to port 1234 on the server and port 80 on

Match Group restricted
    PermitOpen localhost:1234
share|improve this answer
yes, that's what I noticed in my edit. Flagging it as the right answer though. – ixM Jun 6 '12 at 11:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.