I'm trying to set up a user account that can only set up a tunnel for port forwarding on a specific port (9229). I've created the user with a minimal home folder (just a .ssh folder and .ssh/authorized_keys file). I've gotten the private key login working (and have since disabled password login). Now here is my authorized_keys file:
permitopen="localhost:9229",no-pty,no-X11-forwarding,no-agent-forwarding,command="/bin/echo 'Remote shell access has been disabled'" ssh-rsa KEY USER@HOST
Now when I try to set up the tunnel with ssh -i KEY -o ExitOnForwardFailure=yes -L 9229:127.0.0.1:9229 USER@HOST sleep 10, I just get Remote shell access has been disabled. If I remove the command=... part, there's no problem, but then the user can get up to all kinds of stuff.
What am I doing wrong?
I am basing my method on https://stackoverflow.com/questions/8021/allow-user-to-set-up-an-ssh-tunnel-but-nothing-else
I have tried moving the permitopen directive after and before the command directive. I also have tried permitopen=127.0.0.1:9229 and permitopen=:9229.
