How can I restrict a user on the ssh server to allow them only the priviledges for SSH TUNNELING? i.e. So they cannot run commands even if they log in via ssh.
My Linux servers are Ubuntu 11.04 and OpenWrt.
On the server side, you can restrict this by setting their user shell to
On the client side, you will probably want to connect with the
You can control what people can do in ssh by matching groups assuming your version of ssh is new enough to support it (openssh 5.x+).
Basically, we treat them as if they were sftp users, but allow tcp forwarding and optionally specify the destinations they may forward to. If you give them a home directory but don't create any directories under it, they can't transfer any files because they will not have permission to do so.
You can repeat these Match Group blocks for each group that you wish to provide different behavior or restrictions.
You can further control where this person can go on the network using iptables
This assumes the group "nicepeople" GID is 500.
Some of the above ssh options are available in the older versions of openssh, but not within the Match Group section. Match Group is very limited in OpenSSH 4.x and earlier.