Red Hat LINUX 7.2 Reference Manual page 164

164
As you might imagine, X11 forwarding can be very useful. For example, you can use X11 forward-
ing to create a secure, interactive session with the up2date GUI on the server to selectively update
packages (if you have the necessary Red Hat Network packages installed on the server). To do this,
simply connect to the server using ssh and type:
up2date
You will be asked to supply the root password for the server. Then, the Red Hat Update Agent
will appear and you can update your packages on the server as though you were sitting in front of the
machine.
The processing overhead required to encrypt and decrypt the secure information being sent over the
channel, plus the extra bandwidth necessary to send encrypted X application data, may be significant,
however. Adequate testing is required to make sure that the X program is still usable, given your
particular hardware and bandwidth conditions.
10.5.2 TCP/IP Forwarding
TCP/IP forwarding works with the SSH client requesting that a particular port on the client or server
side be mapped over the existing SSH connection.
To map a local port on the client to a remote port on the server, you first have to know the port numbers
on both machines. It is even possible to map two non-standard, different ports to each other.
To create a TCP/IP forwarding channel which listens for connections on the local host, use the follow-
ing command (all on one line):
ssh -L <local-port> : <remote-hostname> : <remote-port>
Setting up TCP/IP forwarding to listen on ports below 1024 requires root
access, just as starting services that listen on ports below 1024.
For example, if you want to check your email on a server called mail.domain.com using POP and SSH
is available on that server, you can use this command to set up TCP/IP forwarding:
ssh -L 1100:mail.domain.com:110 mail.domain.com
After the TCP/IP forwarding is in place between the two machines, you can direct your POP mail
client to use localhost as the POP server and 1100 as the port to check for new mail. Any requests sent
to port 1100 on your system will be directed securely to the mail.domain.com server.
<username> @ <hostname>
Note
Chapter 10:SSH Protocol