Chapter 3. Advanced Use of SSH

Table of Contents
Port forwarding
Configuration options

This section describes some of the more advanced use of SSH. This section is not necessary for everyday use of SSH, but it will make everyday use much easier.

Port forwarding

SSH supports the ability to forward ports on both the local and remote machines. This allows you to access non-telnet services through an encrypted channel. You can forward a local port to port 110 on another machine, for instance, to securely check POP mail on that machine.

Forwarding local ports is the most useful option. This allows you to specify a local port number which can then be used securely access a remote port. To see exactly how this is useful, we look at forwarding port 12345 on the localhost to port 110 on machine foobar.berkeley.edu; port 110 is the port used for POP mail, and by doing this we can point our mail reader to check 'localhost:12345' for POP mail, it will really (securely) be connecting to 'foobar:110', and the mail reader will get the POP service it expects on the remote machine.

To do this, execute the following command:

ssh [-l username] {-L localport:remoteHost:remotePort} {remoteHost} {command}

followed by the command which will use that port, as in:
% ssh -L 12345:foobar.berkeley.edu:110 foobar.berkeley.edu sleep 5
% fetchmail [other options] --port 12345 localhost
A secure connection to the remote machine (foobar.berkeley.edu, in this case) will be made, and connections to port 12345 on the local host will be forwarded to port 110 on foobar. The command sleep 5 will be executed on foobar, which will cause the connection to be left open for a short while... hopefully just enough time to create the connection to check mail with fetchmail.