Mysql – Why is the thesql client utility not using the port I specify

If you use SSH tunneling, then your SSH and MySQL passwords are both encrypted during communication -- as well as all data that passes through the tunnel. If you're not using an SSH tunnel and you're not using MySQL's SSL support, there is no encrypting and a malicious third party could use packet sniffing or other nefarious means to eavesdrop on your communications.

Also, if you're using SSH tunneling, then you will be alerted if the remote machine's SSH key changes. This will not happen with standard MySQL, meaning an attacker could use IP spoofing or a Man in the Middle attack to disrupt/interfere/eavesdrop on your communications.

For more information, see:

• https://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_8-3/ssh.html
• http://ciscoblog.globalknowledge.com/2009/06/10/telnet-vs-ssh/
• http://en.wikipedia.org/wiki/Tunneling_protocol

This should work:

ssh -L 3310:127.0.0.1:3306 user@server

The first port number is the local port to use (must not be in use already), the IP in between the colons is the IP to connect to, from the perspective of the host you are sshing into. The second port number is the port to connect to. If you are connecting to a server other than the one you are sshing into, then try the following:

ssh -L 3310:<remote-IP>:3306 user@server

Usually, when I want to do this more than one time, I create an entry in ~/.ssh/config like the following where sshhost.example.com is the server I am sshing to, the local port I want to open is 5910, the IP on the other side I want to connect to is 192.168.35.69, and the port I want to connect to there is 5900:

Host desk
    Hostname sshhost.example.com
    User jed
    Port 22
    LocalForward 5910 192.168.35.69:5900

Then from a command prompt I can just do

jed@jed-mbp:~$ ssh desk

and get a tunnel to my desktop at the office.

Good luck,

--jed