I'm trying to restrict users who connect via ssh on a server (with OpenSSH) to do local port forwarding on certain ports only.
I've found that setting the
permitopen="address:port" option in their
~/.ssh/authorized_keys files do what I expect.
However it is not very convenient since I have to edit all existing authorized_keys files and if, in the future, I want to allow more ports, change the allowed ports,... I will have to edit them all again.
Is something similar achievable for all users in a group i.e. "allow local port forwarding only on address:port if the user belongs to this group"?
EDIT> it seems that the sshd_config file has a feature which allows this: Match. I can match an user or a group and apply some custom configs for them among which PermitOpen which I must have skipped while reading the man page for the first time.