I need to limit which ports can be remotely 'ssh -R' forwarded by an user.

I know about permitopen option on authorized_keys, but as it says on man page it only limits local 'ssh -L' port forwarding

As discussed here a user would get the same with netcat or similar, but in this case user has no shell access

I also found this thread that talks about using selinux or LD_PRELOAD, but I never configured selinux before and can't find info on how to do that with LD_PRELOAD.

maybe someone have made a patch for openssh to implement that?

EDIT: I've found this bug report so I guess it's not yet implemented

  • Have you found a solution for this?
    – alex88
    Dec 20, 2016 at 10:50
  • I didn't, I guess it can't be done until the above bug is closed or someone writes a patch to implement this
    – Lluís
    Dec 20, 2016 at 12:12

4 Answers 4


This has been implemented in OpenSSH 7.8p1, which was released 2018-08-24. Quote from the release notes:

add a PermitListen directive to sshd_config(5) and a corresponding permitlisten= authorized_keys option that control which listen addresses and port numbers may be used by remote forwarding (ssh -R ...).


There's an option no-port-forwarding that you can use, that prevents all port forwarding. Present at least as of OpenSSH 4.3p2 (CentOS 5.3 - oldest machine I have access to). Put it in the same place that you would have put permitopen.

  • 13
    Completely disabling port forwarding seems overkill and not fit for the question. I assume OP wants to limit it, yet allowing some specific remote port forwardings.
    – gertvdijk
    Dec 28, 2012 at 14:35
  • 2
    Yes, I need to allow some ports forwarding
    – Lluís
    Dec 28, 2012 at 16:59

It isn't possible to limit that using ssh. Maybe selinux or iptables could be used to that end. However, there is an alternative strategy which may or may not suit your needs. Use binding to UNIX sockets. This should be available starting from openssh version 6.8.

When using sockets you have the filesystem ACL (though wether sockets respect that may be *nix dependant) at your disposal and you can use it to prevent one user from binding to another ones sockets. However, it doesn't prevent binding to ports in any way, so depending on your use case it may not help, but maybe ports don't matter if you can consistently only use sockets.

With UNIX sockets handling dangling socket files may be problematic as reverse publishers try to reconnect. I have another question (and answer) to that problem. In short you probably also want to use StreamLocalBindUnlink yes:

How to cleanup SSH reverse tunnel socket after connection closed?


Duplicate: https://superuser.com/questions/516417/how-to-restrict-ssh-port-forwarding-without-denying-it

Looks like you can use the following?

In the server configuration file there is a PermitOpen option. This option can be used to specify hosts and ports for which forwards can be established. This option can be used inside a Match block, so it can be restricted by user, group, or hostname or IP address pattern.

Edit: So in the Server config add the following

PermitOpen host:port

PermitOpen IPv4_addr:port

PermitOpen [IPv6_addr]:port

  • 1
    Only on U&L can be marked as duplicate.
    – GAD3R
    Dec 22, 2016 at 21:27
  • 1
    As stated in the question, that's for -L and it's already known as a non solution
    – alex88
    Dec 23, 2016 at 11:54
  • 1
    Will there ever be a solution to this (beside iptables)?
    – davesave
    Feb 1, 2017 at 9:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .