Create a tunnel user on Ubuntu

Adapted from: https://www.joshcurry.co.uk/posts/ssh-create-a-tunnel-only-user-for-reverse-tunnels

sudo useradd -m tun-user

sudo nano /etc/ssh/sshd_config

Match User tun-user
    AllowAgentForwarding no
    PasswordAuthentication no
    X11Forwarding no
    GatewayPorts no
    PermitTunnel no
    ForceCommand echo 'Port binding...  ctrl + c to exit'
    AllowStreamLocalForwarding no
    #AllowTcpForwarding remote
    PermitOpen localhost:9009

sudo su tun-user

ssh-keygen -t rsa -b 4096

cp ~/.ssh/id_rsa.pub ~/.ssh/authorized_keys

And now, copy ~/.ssh/id_rsa or a different keyfile if you used that, to the remote machine which you will be forwarding from.

exit to usual user.

cp /bin/bash /bin/rbash

usermod -s /bin/rbash tun-user

On local machine

ssh -i ~.ssh/id_rsa_tun_user -l tun-user  -L 9999:localhost:9009 33.22.11.69