Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to limit which ports can be remotely 'ssh -R' forwarded by an user.

I know about permitopen option on authorized_keys, but as it says on man page it only limits local 'ssh -L' port forwarding

As discussed here an user would get the same with netcat or similar, but in this case user has no shell access

I also found this thread that talks about using selinux or LD_PRELOAD, but I never configured selinux before and can't find info on how to do that with LD_PRELOAD.

maybe someone have made a patch for openssh to implement that?

EDIT: I've found this bug report so I guess it's not yet implemented

share|improve this question

There's an option no-port-forwarding that you can use, that prevents all port forwarding. Present at least as of OpenSSH 4.3p2 (CentOS 5.3 - oldest machine I have access to). Put it in the same place that you would have put permitopen.

share|improve this answer
Completely disabling port forwarding seems overkill and not fit for the question. I assume OP wants to limit it, yet allowing some specific remote port forwardings. – gertvdijk Dec 28 '12 at 14:35
Yes, I need to allow some ports forwarding – tictacbum Dec 28 '12 at 16:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.