Crypto tunnels with SSH Requires SSH on client and server Server authentication via SSH host keys Client authentication via Password, Kerberos, SSH PubKey/Identity authentication, etc Several methods to allow secure unattended authentication Tunneled connections are encapsulated in the existing SSH TCP connection.