In order to access my desktop or the hpc cluster at my university, I need to go though an intermediary server managed by the university.

Currently I use the "netcat method" (ssh -W) to access the desktop and hpc cluster. I have also previously used tunnelling (-L) to access these boxes.

What is the difference security-wise between these methods, given that I don't entirely trust the intermediary server?

1 Answer 1


There is no difference between those two methods as far as security is concerned.

In both cases, you first establish a connection between your current computer and the ssh proxy and then tunnel another connexion to your desktop or cluster inside the original connexion.

If you don't trust the intermediary server, your main concern should be to make sure that you're actually connecting to the real computers at the end and that your connection has not been tampered with by the ssh proxy.

To check this, you should compare the ssh host key fingerprints from your desktop and cluster computers to the one you accepted in your ~/.ssh/known_hosts file. If there is a mismatch, you ssh sessions have been intercepted (MITM) since the very beginning.

This is a perfect example of the importance of the often undervalued question asked upon a first ssh connexion:

The authenticity of host 'example.com (' can't be established.
RSA key fingerprint is xx:xx:xx:xx:xx:xx:xx:xx:xx:xx.
Are you sure you want to continue connecting (yes/no)?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .