I would like to restrict port-forwarding from an SSH user identified by password.


In the following explanation of how to install a git server:


They explain that an SSH user with limited or no shell access could still use port-forwarding and some other OS services.

At this point, users are still able to use SSH port forwarding to access any host the git server is able to reach.

In this same text, they solve the problem by restricting SSH access in ~/.ssh/authorized_keys using no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty.

I would like to do the same using password identification: I know that asymmetric cryptographic keys are usually more secure than password, but it also prevent accessing a server from "anywhere" without having your private key in the pocket.

It seems (to me) that authorized_keys only applies to ssl key identification and not to password.

How to limit port forwarding when using password identification?

Note: Using CentOS 8

1 Answer 1


you can do the same in sshd.config but you need to disable shell access, because they still can run their own sshd see this question

AllowTcpForwarding no
AllowStreamLocalForwarding no
GatewayPorts no
PermitTunnel no
  • Thank you. I will also look git-credentials. Commented Apr 23, 2020 at 5:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .