-The tunnel is always set up by one of its endpoints, using ssh. So
-the active endpoint must have ssh installed; the passive endpoint must
-have sshd accessible to the active endpoint, and be willing to allow
-the active endpoint to run the appropriate command.
+The tunnel is always set up by one of its endpoints, using ssh (we
+recommend you use OpenSSH). So the active endpoint must have ssh
+installed; the passive endpoint must have sshd accessible to the
+active endpoint, and be willing to allow the active endpoint to run
+the appropriate command.