tunnel: open + record ssh forwards