SSH Tunneling

When You Need It

Production databases usually aren't exposed to the internet. If your server is only reachable from a jump host, Sutido tunnels the connection through SSH for you:

Your machine  →  SSH tunnel (jump host)  →  database server

Tunneling works for every engine — it wraps the connection, not the protocol.

Setting It Up

Enable SSH tunnel in the connection form and fill in:

• SSH host and port (default 22)
• SSH username
• Auth: a password, or a private key file with an optional passphrase

The database host/port in the main form are then interpreted from the jump host's point of view — if the database runs on the SSH server itself, use localhost and the database's local port.

How to: reach a private RDS/VM database through a bastion

1. Open the Connection Manager and create a connection for your engine as usual
2. Enable SSH tunnel and enter the bastion: host, port 22, your SSH user, and your private key file (plus passphrase if the key has one)
3. Set the database host to the address the bastion sees — the private IP or internal DNS name, e.g. 10.0.1.12 or mydb.internal
4. Click Test connection — on the first connect, Sutido records the bastion's host key
5. Save and connect; the tunnel opens and closes with the connection automatically

Host Keys: Trust On First Use

On the first connection to an SSH server, Sutido records the server's host key. If that key ever changes, the connection stops and a native dialog shows you the old and new fingerprints — you decide whether to trust the new key. No silent failures, and no silently trusting a possibly-hijacked server.

Credentials

SSH passwords, private keys and passphrases are stored with OS-level encryption in Sutido's secret store — never in plaintext. See Authentication & Secrets.

Example: Cloud VM

• SSH host: bastion.example.com, user ubuntu, key C:\Users\you\.ssh\id_ed25519
• Database host: 10.0.1.12 (the private address the bastion can reach), port as usual

Troubleshooting

Authentication failed

Verify the username and key with a regular SSH client first. If the key has a passphrase, make sure it's entered in the connection form.

Tunnel connects, database doesn't

The database host must be reachable from the jump host. SSH into the bastion and check connectivity from there.

Host key warning appeared

If you didn't expect the server's key to change (no reinstall, no infra migration), treat the warning seriously before accepting — that's exactly the scenario the dialog exists for.

Next Steps

Read how Sutido stores credentials in Authentication & Secrets.