This question is related to this one, here, but the accepted answer for that question does not actually answer the question and is inaccurate, as pointed out in this comment.

Basically, I have a similar situation as the other post's author. I have an sshd server with password authentication disabled, and I sometimes need to open up a port on that server to proxy connections to a machine that lacks some tools that I need. I can accomplish this by executing the following command from the machine to which I want the connections forwarded.

$ ssh -nNTR 22122 user@sshd-server

This works fine, but I want to restrict incoming SSH connections to only open a remote listener on one particular port while disallowing local port forwards and shell commands. In other words, all the following commands should fail.

$ ssh user@sshd-server
$ ssh -nT user@sshd-server <any-command>
$ ssh -nNTL 22122:localhost:22122 user@sshd-server
$ ssh -nNTR 10000 user@sshd-server

Here is what I placed in my ~/.ssh/authorized_keys file to try to accomplish this, but it is currently preventing me from executing any of the above commands, including the one that I actually want to work.

restrict,command="/bin/false",permitlisten="localhost:22122" ssh-ed25519 ... user@kali

What am I doing wrong?

  • As pointed out here, a possible solution is to set AllowTcpForwarding equal to remote in /etc/ssh/sshd_config, but I'd ideally like to set this option on a per-user / per-key basis, rather than globally.
    – jinscoe123
    Jul 3, 2023 at 4:30


You must log in to answer this question.

Browse other questions tagged .