How to forbid port-forwarding for a password protected SSH user?

Question

Brief:

I would like to restrict port-forwarding from an SSH user identified by password.

Explanation:

In the following explanation of how to install a git server:

https://git-scm.com/book/en/v2/Git-on-the-Server-Setting-Up-the-Server

They explain that an SSH user with limited or no shell access could still use port-forwarding and some other OS services.

At this point, users are still able to use SSH port forwarding to access any host the git server is able to reach.

In this same text, they solve the problem by restricting SSH access in ~/.ssh/authorized_keys using no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty.

I would like to do the same using password identification: I know that asymmetric cryptographic keys are usually more secure than password, but it also prevent accessing a server from "anywhere" without having your private key in the pocket.

It seems (to me) that authorized_keys only applies to ssl key identification and not to password.

How to limit port forwarding when using password identification?

Note: Using CentOS 8

Answer 1

you can do the same in sshd.config but you need to disable shell access, because they still can run their own sshd see this question

AllowTcpForwarding no
AllowStreamLocalForwarding no
GatewayPorts no
PermitTunnel no