search for: somerandommachin

...shell. All we wanted them to do was this: ssh -N -L <somePort>:localhost:<someOtherPort> foo.bar.com We only wanted them to port forward to one host, localhost. We didn't want them to be able to forward any ports to any other host, like this: ssh -N -L <somePort>:someRandomMachine:<someOtherPort> foo.bar.com While a firewall would block anyone from trying to port forward to *any* host on the Internet, if you allow port forwarding, the user can port forward to machines that are on the same network as the ssh server which don't have personal firewalls installed, et...