In the local port forwarding invocation below,
[me@TunnelBeginHost]$ ssh -L TunnelBeginPort:TunnelEndHost:TunnelEndPort ViaUser@ViaHost
, given the fact that the portion of the tunnel between
TunnelEndHost is insecure, prone to network sniffing and all that, why is
ssh even providing such an option? Security being at the heart of
ssh, shouldn't it have required authentication at the TunnelEndHost as well..., say with a (hypothetical) syntax such as,
[me@TunnelBeginHost]$ # Proposed syntax: [me@TunnelBeginHost]$ ssh -L TunnelBeginPort:TunnelEndUser:TunnelEndHost:TunnelEndPort ViaUser@ViaHost
that would have ensured a secure tunnel between
TunnelEndHost as well?
Likewise, for remote port forwarding.
Understanding the rationale behind this capability of
ssh will help clear up any misconceptions I may have about
ssh-tunneling, or about security caveats associated with it.