Connecting to MySQL with SSH Tunnel? Would this be a good/secure workaround?

Hello,

I know that directly connecting to a MySQL database on internet is not a good idea, but if we use a SSH Tunnel (like Putty or Chilkat ActiveX) would this be a secure solution?
So that we don't need to rewrite the whole legacy app codded in vb6 to use webservices?

Do you have any experiences with this SSH tunneling?

Thanks,
Davor

bitvise ssh client or putty both allow you to do the ssh connection, you can configure it to open a local port that it then proxies to the remote machine.
this way you can set your mysql server to only listen on localhost and/or block 3306 at the firewall so its not web accessible.

on your dev machine you open the ssh tunnel with the proxy configured. then on the dev machine you can connect to localhost 3307 or whatever
and it will be automatically forwarded to the server 3306.

This is how I access my web server mysql instances for dev/backups etc works great.

Windows 10 has had the OpenSSH client (and optional server) for a long time now.

Attachment 181361

I plan to have a few MySQL databases on the sever, and if I give the users SSH access so that they can securely connect to the database. What should I do to disable the user to run any commands on the server and to only allow him to connect to his database on this server and NOT to be able to see and "play" with other databases that are on the server if I give him the SSH access to the server?

I wouldnt let anyone ssh into my server. Maybe allowing them to VPN into a specific point of your network and then access mysql that way.
You will probably get the best answers from a Linux admin forum .

Quote:

---

Originally Posted by Davor Geci

What should I do to disable the user to run any commands on the server and to only allow him to connect to his database on this server and NOT to be able to see and "play" with other databases that are on the server if I give him the SSH access to the server?

---

In sshd_config you have to use ForceCommand to disable shell for instance something like this

Code:

---

Match Group sshusers
    ForceCommand  /bin/false
    . . .

---

. . . where sshusers above is a users group on the ssh host. Find a tutorial how to configure openssh access.

You might want to disable password auth too and accept pubkey auth only. (This is what we do.)

For MySQL you'll probably need a second pair of user/pass which you can authorize access to specific DBs. Never done it personally but this is what we do with our MSSQL instances here.

cheers,
</wqw>