Visual RFC.
ALL RFCs / RFC 4251
Read the RFC ↗
RFC 4251 / MECHANISMS

One transport carries channels

04

Logical shell and forwarding channels share an authenticated encrypted connection.

Related RFCs and changes

“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.

DIAGRAM§ 1 ↗
RFC 4251 · § 1EXAMPLE
3 / 3
One transport carries channelsLogical shell and forwarding channels share an authenticated encrypted connection. Current state: Policy gate.One transport carries channelsone protected SSH transportshellport forwardingforwarding policy
03
Policy gate

Permit only the services and forwarding directions allowed by policy.

Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
KEY POINT

Channel multiplexing belongs to the connection protocol.

  • Channel multiplexing belongs to the connection protocol.
  • Forwarding is an authorized capability, not an automatic entitlement.
  • Endpoint security and forwarding policy still matter.
DETAILS

The illustration is schematic. Example values are illustrative; profiles and later security guidance can add requirements.

Read the RFC section ↗

Diagrams simplify the RFC. Read the linked sections for complete requirements.

Privacy
All chapters in this RFC
  1. Three layers have different jobs
  2. Host keys identify the server
  3. An unchecked key enables a middleman
  4. One transport carries channels
  5. Security has endpoint limits
RFC 9700 / CHAPTERS

Chapters

For full details, tables, algorithms, and exceptions, read the original RFC.

RFC status and corrections ↗