In the local port forwarding invocation below,
[me@TunnelBeginHost]$ ssh -L TunnelBeginPort:TunnelEndHost:TunnelEndPort ViaUser@ViaHost
, given the fact that the portion of the tunnel between ViaHost
and TunnelEndHost
is insecure, prone to network sniffing and all that, why is ssh
even providing such an option? Security being at the heart of ssh
, shouldn't it have required authentication at the TunnelEndHost as well..., say with a (hypothetical) syntax such as,
[me@TunnelBeginHost]$ # Proposed syntax:
[me@TunnelBeginHost]$ ssh -L TunnelBeginPort:TunnelEndUser:TunnelEndHost:TunnelEndPort ViaUser@ViaHost
that would have ensured a secure tunnel between ViaHost
and TunnelEndHost
as well?
Likewise, for remote port forwarding.
Understanding the rationale behind this capability of ssh
will help clear up any misconceptions I may have about ssh
-tunneling, or about security caveats associated with it.