How can I restrict a user on the SSH server to allow them only the privileges for SSH TUNNELING? i.e. So they cannot run commands even if they log in via SSH.My Linux servers are Ubuntu 11.04 and OpenWrt.
How to restrict an SSH user to only allow SSH-tunneling?
linux;ssh;account restrictions
On the server side, you can restrict this by setting their user shell to /bin/true. This will allow them to authenticate, but not actually run anything since they don't get a shell to run it in. This means they will be limited to whatever subset of things SSH is able to offer them. If it offers port forwarding, they will still be able to do that.On the client side, you will probably want to connect with the -N. This stops the client from ASKING for a remote command such as a shell, it just stops after the authentication part is done. Thanks to commentors for pointhing this out.