I want to setup a RHEL7 host that will allow a few people to ssh in. Let say 10 people will be able to access the box via ssh. Of those 10 people I only want 3 to be able to create a tunnel to other resources behind the firewall via a ssh tunnel. Is this possible?

I know I can use AllowUser and AllowGroup so that only the 10 people can ssh into the host. In I can leave AllowTcpForwarding on, but that would give everyone the ability to create ssh tunnels. I need only allow the 3 approved users.


Something like this in your sshd_config file should do what you want:

AllowTcpForwarding off
Match user user1,user2,user3
    AllowTcpForwarding on

This will permit TCP forwarding for the three listed users.

See sshd_config Match for more details about how the Match directive works and which options can be set in a match block.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.