# The tunnel account must use /usr/sbin/nologin (or /bin/false).
# Validate with: sshd -t
# Recommended authorized_keys prefix for every Agent key:
# command="/usr/sbin/nologin",no-agent-forwarding,no-X11-forwarding,no-pty,no-user-rc,permitlisten="127.0.0.1:*" ssh-ed25519 AAAA...
Match User tunnel
    AuthenticationMethods publickey
    PasswordAuthentication no
    KbdInteractiveAuthentication no
    AllowTcpForwarding remote
    GatewayPorts no
    PermitListen 127.0.0.1:*
    PermitTTY no
    X11Forwarding no
    AllowAgentForwarding no
    PermitUserRC no
    ForceCommand /usr/sbin/nologin
