Correction for <http://openssh.org/faq.html#2.11>?

>2.11 - How do I use port forwarding?
>
>If the remote server is running sshd(8), it may be possible to 
>``tunnel'' certain services via ssh. This may be desirable, for 
>example, to encrypt POP or SMTP connections, even though the 
>software does not directly support encrypted communications. 
>Tunnelling uses port forwarding to create a connection between the 
>client and server. The client software must be able to specify a 
>non-standard port to connect to for this to work.

	I don't agree with the last sentence. The standard port can 
be tunnelled if a) the standard port is high, b) the client doesn't 
restrict low port listeners (Windows), or c) the user has root-level 
access.


	It would be helpful if the ssh manual page and FAQ could give 
more insight on what belongs in the middle of the -L argument -- I 
often see examples showing localhost/127.0.0.1 and other times 
showing the server hostname, but have yet to find a clear explanation.

	The current manual page 
<http://www.openbsd.org/cgi-bin/man.cgi?query=ssh> is somewhat 
clearer, but still not quite Waterford.

>      -L [bind_address:]port:host:hostport
>              Specifies that the given port on the local (client) host is to be
>              forwarded to the given host and port on the remote side.  This
>              works by allocating a socket to listen to port on the local side,
>              optionally bound to the specified bind_address.  Whenever a con-
>              nection is made to this port, the connection is forwarded over
>              the secure channel, and a connection is made to host port
>              hostport from the remote machine.  Port forwardings can also be
>              specified in the configuration file.  IPv6 addresses can be spec-
>              ified with an alternative syntax: [bind_address/]port/host/host-
>              port or by enclosing the address in square brackets.  Only the
>              superuser can forward privileged ports.  By default, the local
>              port is bound in accordance with the GatewayPorts setting.  How-
>              ever, an explicit bind_address may be used to bind the connection
>              to a specific address.  The bind_address of ``localhost'' indi-
>              cates that the listening port be bound for local use only, while
>              an empty address or `*' indicates that the port should be avail-
>              able from all interfaces.

	From this text, it sounds like ssh accepts connections at 
port (on the client), and passes them through the tunnel to sshd (on 
the server), which points the tunnel to host:hostport, so localhost 
vs. servername should generally not matter, but clarity would be most 
welcome here.

	It would be helpful to use the same terminology through the 
description -- i.e., change the first sentence to something like: 
"Specifies that the given port on the local (client) host is to be 
forwarded to the given host and hostport on the remote side. Note 
that host and hostport are from the perspective of sshd (not ssh), so 
localhost refers to the server, not the ssh client."


						Thanks for OpenSSH!


						Chris Pepper
-- 
Chris Pepper:               <http://www.reppep.com/~pepper/>
Rockefeller University:     <http://www.rockefeller.edu/>