OpenSSH: tunnel-only user

To create a SSH user which is only allowed SSH tunneling, add the following to /etc/ssh/sshd_config: