Protecting Your Database

---

Applies to SSHepherd 2.0

Overview

These steps protect a MySQL server with SSHepherd®, so you can close its listening port to the network and still let authorized users reach the database.

Before you start

• The SSHepherd® Agent is installed on the MySQL server.
• The Control App or shepctl is installed on the user’s computer.
• The user and the MySQL server are in the same SSHepherd® group, or the user has a Generic tunnel definition for it.

Configure the MySQL server host

1. Allow MySQL’s port on the agent:
   1. In the Administrator Console, click Agents and select the MySQL server.
   2. Click the Settings tab.
   3. Add 3306 to Allowed Ports.
   4. Click Save.
   The agent applies the change within seconds.
2. Close port 3306 to the network. For example, set MySQL’s bind-address to 127.0.0.1, or block the port in the host firewall. The agent connects to MySQL on 127.0.0.1, so binding MySQL to localhost works.
3. Make sure the MySQL accounts that users sign in with are allowed to connect from 127.0.0.1. MySQL sees every SSHepherd® connection as coming from there.

Connect with shepctl

1. Sign in to SSHepherd®: shepctl --url https://your.sshepherd.server login
2. Open the tunnel: shepctl --hostname <mysql server host name> --relayport 3306 tunnelshepctl prints the local port, for example tunnel open on localhost: 55777.
3. In a second terminal, connect the MySQL client to that port: mysql -h 127.0.0.1 -P 55777 -u <mysql user> -p

To use the same port every time, add --port, for example --port 3307.

Connect with the Control App

1. Ask your administrator for a Generic tunnel definition with To Agent set to the MySQL server, Remote Host 127.0.0.1 and Remote Port 3306. A Specific local port, such as 55777, makes it easy to set up your database tools.
2. In the Control App, switch the tunnel on.
3. Connect your MySQL client or tool to 127.0.0.1 on the tunnel’s local port.