{"id":117,"date":"2012-08-10T18:44:42","date_gmt":"2012-08-10T14:44:42","guid":{"rendered":"http:\/\/xxxl.co.za\/?page_id=117"},"modified":"2012-08-11T21:39:43","modified_gmt":"2012-08-11T17:39:43","slug":"safe-ssh-tunnel-based-mysql-comms","status":"publish","type":"page","link":"https:\/\/xxxl.co.za\/?page_id=117","title":{"rendered":"Safe SSH tunnel based Mysql comms"},"content":{"rendered":"<p>Server:<br \/>\nSetup user with key based authentication:<\/p>\n<pre>\r\nuseradd -s \/bin\/false myuser\r\nmkdir \/home\/myuser\/.ssh\r\ntouch \/home\/myuser\/.ssh\/authorized_keys\r\nchown -R myuser:myuser \/home\/myuser\/.ssh\r\nchmod 755 \/home\/myuser\/.ssh\r\nchmod 600 \/home\/myuser\/.ssh\/authorized_keys\r\n<\/pre>\n<p>Client side:<br \/>\nInstall rpmforge repo and autossh.<\/p>\n<pre>\r\nrpm --import http:\/\/apt.sw.be\/RPM-GPG-KEY.dag.txt\r\nwget http:\/\/packages.sw.be\/rpmforge-release\/rpmforge-release-0.5.2-2.el5.rf.x86_64.rpm\r\nrpm -K rpmforge-release-0.5.2-2.el5.rf.*.rpm\r\nrpm -i rpmforge-release-0.5.2-2.el5.rf.*.rpm\r\nsed -i \"s\/enabled = 1\/enabled = 0\/\" \/etc\/yum.repos.d\/rpmforge.repo\r\nyum -y install --enablerepo=rpmforge autossh\r\nssh-keygen -t rsa\r\n<\/pre>\n<p>Set up an RSA key pair as root on each client, leaving all questions blank:<\/p>\n<pre>\r\nssh-keygen -t rsa\r\nroot@local# ssh-keygen -t rsa\r\nGenerating public\/private rsa key pair.\r\nEnter file in which to save the key (\/var\/root\/.ssh\/id_rsa):\r\nEnter passphrase (empty for no passphrase):\r\nEnter same passphrase again:\r\nYour identification has been saved in \/var\/root\/.ssh\/id_rsa.\r\nYour public key has been saved in \/var\/root\/.ssh\/id_rsa.pub.\r\nThe key fingerprint is:\r\nXX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX root@myhost.local\r\n<\/pre>\n<p>Now scp this to your server:<\/p>\n<pre>\r\nscp -P 22 \/root\/.ssh\/id_rsa.pub root@myserver.com:\/tmp\/myuser.local_rsa.pub\r\n<\/pre>\n<p>On Server: Add to your authorized_keys.<\/p>\n<pre>\r\ncat \/tmp\/myuser.local_rsa.pub >> \/home\/myuser\/.ssh\/authorized_keys\r\n<\/pre>\n<p>Client side:<br \/>\ncreate \/etc\/init.d\/startautossh on client with contents below. \/\/This example nables connection to server MySQL port 3306 on localhost port 3307.<\/p>\n<pre>\r\n\r\n# pidfile: \/var\/run\/autossh.pid\r\n# @since 2012-02-22 15:31:47\r\n# @author Roderick Derks\r\n# Source function library\r\n. \/etc\/init.d\/functions\r\n\r\nprog=\"autossh\"\r\nautossh=\"\/usr\/bin\/autossh\"\r\nRETVAL=0\r\nAUTOSSH_PIDFILE=\/var\/run\/autossh.pid\r\n\r\n# Tunnel configuration\r\nLOCAL_PORT_LISTEN=3307\r\nREMOTE_DESTINATION_PORT=3306\r\nUSER=myuser\r\nREMOTE_DESTINATION_IP=yourserver.com\r\nREMOTE_SSH_SERVER_PORT=22\r\n\r\nstart() {\r\necho -n $\"Starting $prog: \"\r\nif [ ! -e $AUTOSSH_PIDFILE ]; then\r\nAUTOSSH_PIDFILE=$AUTOSSH_PIDFILE;export AUTOSSH_PIDFILE\r\nautossh -M 0 -q -f -N -o \"ServerAliveInterval 60\" -o \"ServerAliveCountMax 3\" -L $LOCAL_PORT_LISTEN:localhost:$REMOTE_DESTINATION_PORT -p $REMOTE_SSH_SERVER_PORT  $USER@$REMOTE_DESTINATION_IP\r\n\r\nRETVAL=$?\r\nelse\r\nRETVAL=1\r\necho_failure\r\necho pid file still exists $AUTOSSH_PIDFILE\r\nfi\r\necho\r\n[ $RETVAL -eq 0 ] && touch \/var\/lock\/subsys\/$prog\r\nreturn $RETVAL\r\n}\r\n\r\nstop() {\r\necho -n $\"Stopping $prog: \"\r\nkillproc $autossh\r\nRETVAL=$?\r\necho\r\n[ $RETVAL -eq 0 ] && rm -f \/var\/lock\/subsys\/$prog && rm -f $AUTOSSH_PIDFILE\r\nreturn $RETVAL\r\n}\r\n\r\ncase \"$1\" in\r\nstart)\r\nstart\r\n;;\r\nstop)\r\nstop\r\n;;\r\nrestart)\r\nstop\r\nstart\r\n;;\r\nstatus)\r\nstatus $autossh\r\nRETVAL=$?\r\n;;\r\n*)\r\n\r\necho $\"Usage: $0 {start|stop|restart|status}\"\r\nesac\r\nRETVAL=1\r\n<\/pre>\n<p>Client side: (make script executeable):<\/p>\n<pre>\r\nchmod +x \/etc\/init.d\/startautossh\r\n<\/pre>\n<p>References:<br \/>\nhttp:\/\/www.r71.nl\/kb\/technical\/348-autossh-init-script<br \/>\nhttp:\/\/tychoish.com\/rhizome\/persistent-ssh-tunels-with-autossh\/<\/p>\n<blockquote class=\"wp-embedded-content\" data-secret=\"BW95ko1ZwP\"><p><a href=\"https:\/\/www.jbmurphy.com\/2011\/04\/29\/autossh-on-centos\/\">AutoSSH on CentOS<\/a><\/p><\/blockquote>\n<p><iframe loading=\"lazy\" class=\"wp-embedded-content\" sandbox=\"allow-scripts\" security=\"restricted\" style=\"position: absolute; visibility: hidden;\" title=\"&#8220;AutoSSH on CentOS&#8221; &#8212; jbmurphy.com\" src=\"https:\/\/www.jbmurphy.com\/2011\/04\/29\/autossh-on-centos\/embed\/#?secret=KYhPkPfJnx#?secret=BW95ko1ZwP\" data-secret=\"BW95ko1ZwP\" width=\"474\" height=\"267\" frameborder=\"0\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\"><\/iframe><br \/>\nhttp:\/\/chxo.com\/be2\/20040511_5667.html<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Server: Setup user with key based authentication: useradd -s \/bin\/false myuser mkdir \/home\/myuser\/.ssh touch \/home\/myuser\/.ssh\/authorized_keys chown -R myuser:myuser \/home\/myuser\/.ssh chmod 755 \/home\/myuser\/.ssh chmod 600 \/home\/myuser\/.ssh\/authorized_keys Client side: Install rpmforge repo and autossh. rpm &#8211;import http:\/\/apt.sw.be\/RPM-GPG-KEY.dag.txt wget http:\/\/packages.sw.be\/rpmforge-release\/rpmforge-release-0.5.2-2.el5.rf.x86_64.rpm rpm -K rpmforge-release-0.5.2-2.el5.rf.*.rpm rpm -i rpmforge-release-0.5.2-2.el5.rf.*.rpm sed -i &#8220;s\/enabled = 1\/enabled = 0\/&#8221; \/etc\/yum.repos.d\/rpmforge.repo yum -y install &#8211;enablerepo=rpmforge &hellip; <a href=\"https:\/\/xxxl.co.za\/?page_id=117\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">Safe SSH tunnel based Mysql comms<\/span> <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"open","template":"","meta":{"footnotes":""},"class_list":["post-117","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/xxxl.co.za\/index.php?rest_route=\/wp\/v2\/pages\/117","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/xxxl.co.za\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/xxxl.co.za\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/xxxl.co.za\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/xxxl.co.za\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=117"}],"version-history":[{"count":5,"href":"https:\/\/xxxl.co.za\/index.php?rest_route=\/wp\/v2\/pages\/117\/revisions"}],"predecessor-version":[{"id":134,"href":"https:\/\/xxxl.co.za\/index.php?rest_route=\/wp\/v2\/pages\/117\/revisions\/134"}],"wp:attachment":[{"href":"https:\/\/xxxl.co.za\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=117"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}