Linux SSHD: Per-User or Per-Group Configuration to Disable or Enable Functionality

To have configurations in sshd_config on a per-user or a per-group basis you need to use the Match Group and Match User directives.

Example

To prevent say remotely running GUI programs for all users save some you can use the following snippet. You can of course make other modifications.

# Disable X11 Forwarding and TCP Forwarding.
X11Forwarding no
AllowTcpForwarding no

# This to enable for a group called "X11AllowedList" that you created with 
# its respective members.
Match Group X11AllowedList
    X11Forwarding yes
    AllowTcpForwarding yes

## OR ##

# Or this to enable for a user specifically.
Match User johndoe
    X11Forwarding yes
    AllowTcpForwarding yes

Summary

The indentation is what makes this possible.

Match User johndoe
    X11Forwarding yes

Advanced: To Restrict Commands

If you want something more sophisticated than just preventing some GUI executions, you will want to create a restricted shell so that the users have limited access. This would then be force executed soon as someone logs in using the ForceCommand Directive as follows:

ForceCommand /usr/local/bin/strict_shell

Accessing IPython Notebook remotely over an SSH tunnel

What is IPython Notebook?

IPython Notebook is the web-based environment that comes with IPython and is used for scientific computing and visualization. From their website:

"A web-based notebook with the same core features but support for code, text, mathematical expressions, inline plots and other rich media."

What we wanted to do?

We wanted to be able to access the IPython Notebook environment remotely from researcher machines.  The reasons for this were multiple:

1. Their data had to reside on the remote machines that we did not have access to. 
2. Install and configuration of IPython on these remote machines was specifically setup for this use and we wanted to keep that environment consistent.
3. There were multiple users that wanted to access the IPython Notebook but also each others' information as needed.

The Solution

The solution was to access the IPython Notebook environment remotely over an SSH tunnel.