The SSH protocol provides the following safeguards:
After an initial connection, the client can verify that it is connecting to the same server it had connected to previously.
The client transmits its authentication information to the server using strong, 128-bit encryption.
All data sent and received during a session is transferred using 128-bit encryption, making intercepted transmissions extremely difficult to decrypt and read.
The client can forward X11[5] applications from the server. This technique, called X11 forwarding, provides a secure means to use graphical applications over a network.
Because the SSH protocol encrypts everything it sends and receives, it can be used to secure otherwise insecure protocols. Using a technique called port forwarding, an SSH server can become a conduit to securing otherwise insecure protocols, like POP, and increasing overall system and data security.
The OpenSSH server and client can also be configured to create a tunnel similar to a virtual private network for traffic between server and client machines.
Finally, OpenSSH servers and clients can be configured to authenticate using the GSSAPI implementation of the Kerberos network authentication protocol. For more information on configuring Kerberos authentication services, refer to Section 43.6, “Kerberos”.
Red Hat Enterprise Linux includes the general OpenSSH package (openssh) as well as the OpenSSH server (openssh-server) and client (openssh-clients) packages. Note, the OpenSSH packages require the OpenSSL package (openssl) which installs several important cryptographic libraries, enabling OpenSSH to provide encrypted communications.
[5] X11 refers to the X11R7 windowing display system, traditionally referred to as the X Window System or X. Red Hat Enterprise Linux includes X11R7, an open source X Window System.
[6] DNS poisoning occurs when an intruder cracks a DNS server, pointing client systems to a maliciously duplicated host.
[7] IP spoofing occurs when an intruder sends network packets which falsely appear to be from a trusted host on the network.