I have a special user on my server, let's call it foo. I use it only for port forwarding.The user's .ssh/authorized_keys2 is set up to prevent login and to open only a specific port:no-pty,no-X11-forwarding,permitopen=localhost:4000,\command=/bin/echo do-not-send-commands ssh-rsa <long public key> bar@foobarAdditionally, the foo has its shell set to /bin/false in /etc/passwd.I can't log onto the machine (that's what I want):$ ssh foo@remotePTY allocation request failed on channel 0Connection to remote closed.But I can open ports. Interestingly, I can open port 4000, but also other unprivileged ports:$ ssh -N -R 4001:localhost:22 foo@remote> # connection establishedOn remote with user bar, I can connect:$ ssh -p4001 bar@localhostbar@localhost's password:Last login: Fri Sep 26 09:23:45 2014 from localhost.localdomain...Why can user foo open port 4001, when I limited it to permitopen=localhost:4000?
ssh settings `permitopen=localhost:4000` does not limit remote port forwarding
ssh;port forwarding;access control
Ah, re-reading the manual reveals the cause:permitopen=host:port    Limit local ``ssh -L'' port forwarding....Also mentioned in this U&L Q&A titled: How can I limit ssh remote port forwarding?.