I want to set up an SSH tunnel to my MySQL database on a remote server. Can I create an SSH user that has only the minimum permissions that are strictly necessary to access MySQL, for example with a database management application like HeidiSQL or Sequel Pro? I don't want the user to be able to access anything else.
How do I create a SSH user that can only access MySQL?
ssh;mysql;ssh tunneling
You can add a user without a valid login shell:# useradd -s /sbin/nologin dbuserSet their password:# passwd dbuserOr leave it unset and make SSH keys:(on local machine)$ ssh-keygen(on remote machine)# su -s /bin/bash - dbuser$ cat local_id_rsa.pub >>~/.ssh/authorized_keysAt this point, you can use SSH to create the tunnel:ssh -TfnN -L localhost:<local_port>:localhost:<db_server_port> dbuser@remote_hostIf you used SSH keys to authenticate, this will work automatically, otherwise you'll need to type in a password. ssh will go to background immediately after authenticating, and will not attempt to execute any command, but the tunnel will be open. Type 'localhost' and the <local_port> value into your local DB client, and it'll work. However:$ ssh dbuser@remote_hostdbuser@remote_host's password:Last login: Fri Oct  9 09:27:24 2015 from local_hostThis account is currently not available.Connection to remote_host closed.SSH will not execute any shell or command as the remote user; /sbin/nologin will kick it out every time.