Skip to content
Coordinator DB
View as Markdown
View as Markdown

Reach SQL through an SSH tunnel ​

SSH keys authenticate access to an SSH host. They do not replace Coordinator DB's SQL username, password or HTTP Bearer key. When an operator already has SSH access to the server host, local port forwarding can provide a protected route to a listener bound to loopback.

sh
ssh -N -L 17401:127.0.0.1:7401 operator@database-host

Keep that connection open, then address the forwarded port from a separate terminal:

sh
curl --fail-with-body --silent \
  --user "$COORDINATOR_USER:$COORDINATOR_PASSWORD" \
  --data-binary 'SELECT 1 FORMAT csv' http://127.0.0.1:17401/

Confirm both ends ​

The remote 127.0.0.1:7401 must be the HTTP listener reachable from the SSH host. Choose another local port if 17401 is already occupied. For native SQL, forward the native port and pass the corresponding local address to coordinator client --addr.

A successful SSH login proves only host access. A 401 response still requires checking the database credentials. A forwarding error requires checking the listener and route on the remote side. Do not publish private keys or passwords in a support report.

This is an external transport workflow; Coordinator DB does not manage SSH accounts or keys.

See native client options and HTTP authentication.