I need to restrict SSH tunnel functions. Users should not be allowed to create remote tunnels but only tunnels to localhost. I tried to setup the whole thing in the SSH configuration but I can only turn off the TCPForwarding completely there. I guess this might only be possible with iptables then? Does anyone have experience and can help me out?
For OpenSSH you can use
From the man page for sshd_config: