Crypto tunnels with SSH (cont) Server authentication via SSH host keys. Client authentication via: Password, Kerberos, SSH PubKey/Identity authentication, etc. Multiple methods to allow secure unattended authentication. Come in two flavours: LocalForwards RemoteForwards