Suppose I have created an account whose login shell is actually a script which does not permit an interactive login, and only allows a very limited, specific set of commands to be remotely executed.

Nevertheless, ssh allows the user of this account to forward ports, which is a hole.

Now, the twist is that I actually want that account to set up a specific port forwarding configuration when the ssh session is established. But it must be impossible configure arbitrary port forwarding.

(It is an acceptable solution if the permitted port forwarding configuration is unconditionally established as part of the every session.)