title: Using SSH for both SFTP AND Port Forwarding in a chroot'ed environment
body: <p>My goal is to have these things working:</p>
  
  <ul>
  <li>User can connect to Server via sftp. He can only read contents from his home directory (hence, he can use <em>sftp user@host</em>)</li>
  <li>User can connect to Server and open a remote port for port forwarding (hence, he can use <em>ssh -R remote_port:localhost:port user@host</em>)</li>
  <li>User can <strong>not</strong> do anything but those two things. He should not have normal shell access and should not be able to run commands.</li>
  </ul>
  
  <p>I can get either case to work, but not both at the same time. </p>
  
  <p>My /etc/sshd_config is:</p>
  
  <pre><code>Match Group restricted
      ChrootDirectory /home/restricted/users
      AllowAgentForwarding no
      X11Forwarding no
      AllowTcpForwarding yes
      ForceCommand internal-sftp
  </code></pre>
  
  <p>Obviously this is the working case for sftp. With this configuration, it is impossible to open a remote port for port forwarding.</p>
  
  <p>The only way for me currently to allow tcp forwarding is disabling the <em>ForceCommand</em> and the <em>ChrootDirectory</em> directives.</p>
  
  <p>Also, I have to change the shell to /bin/bash to allow port forwarding.</p>
  
  <p>My dream situation would be:</p>
  
  <ul>
  <li>/bin/false (or equivalent) as shell</li>
  <li>chrooted to home directory</li>
  <li>sftp works</li>
  <li>port forwarding works</li>
  <li>nothing else works</li>
  </ul>
  
  <p>Is that even possible? And if so, what do I need to do?</p>
  
  <p>Thanks in advance.</p>