cPanel prior to 64.0.21 allows demo and suspended accounts to use SSH port forwarding (SEC-247).
cpanel cpanel