Querious Help 5

Connecting through SSH

Querious can utilize SSH to create secure encrypted connections to remote servers.

When using SSH, all communication with the MySQL server is forwarded through a secure tunnel created by SSH.

How an SSH tunnel carries the connection
How an SSH tunnel carries the connection
  1. Querious fires up a local SSH process.
  2. The local SSH process creates a secure connection to SSH on a remote machine called the SSH Host.
  3. The local SSH process listens to all traffic on a local Tunnel Port.
  4. The local SSH process forwards all traffic coming into this local port, over the secure tunnel to the SSH Host
  5. The remote SSH process then sends all it receives over a connection to the destination Host on the given Port.

Host vs SSH Host #

With SSH, the Host field is resolved from the SSH server's point of view. Often the SSH Host and the database server Host are actually the same machine, but that isn't always the case.

When the database is on the same machine as the SSH server, the "Host" setting would simply be localhost or 127.0.0.1, not its public IP address or name.

SSH settings

If for some reason you need to customize the tunnel creation, you can create an SSH tunnel using the command line instead of Querious, and then manually specify the tunnel port to use.

Key-based Authentication #

To use a private/public key pair:

  1. Click on the key button at the end of the SSH Password field
  2. Select the private key file.

Password-Protected Key Files

    If the private key file is password-protected, then you'll need to enter the password so SSH can read and use the key. Querious will automatically ask for the key file's password if needed, or you can enter it so it always has it. (For a saved connection, this password will be remembered in Keychain.)

  1. Select the private key file as noted above.
  2. Click on the SSH Password field.
  3. Type in the key file's password.

If your private/public key pair is already registered with ssh-agent, or is one of the standard key names (id_rsa, id_dsa, etc) you may not need to select the key at all.

When connecting to SSH, all key types supported by the $ ssh command are supported.

Creating an SSH Tunnel without Querious #

  1. Open Terminal.app and enter: 
    ssh -N username@serveraddress -L 8888:127.0.0.1:3306
    • "username" should be the remote username used to create an SSH connection at the internet address given by "serveraddress".
    • 8888 is simply any local unused port number.
    • 3306 is the remote port for the database service (3306 is the default port for MySQL).
    You can change these settings as needed.
  2. After pressing return and entering in your SSH password, you can then use Querious to connect to the remote server.
  3. Open Querious and connect to the remote server by entering "127.0.0.1" into the Host field, and "8888" into the Port field. When you connect, all traffic sent to port 8888 of 127.0.0.1 will be encrypted and forwarded to port 3306 of the "serveraddress" machine specified in the SSH connection.