Database SSH Tunnels and Security
Use an SSH tunnel when the database listens on a private address that is reachable from an SSH server but should not be exposed directly to the internet.
Configure an SSH Tunnel
- In the Add or Edit Database dialog, enable Connect through SSH tunnel.
- Enter the SSH host, port, and username.
- Select password or private-key authentication.
- For key authentication, choose the private-key file and enter its passphrase if required.
- Keep the database host set to the address seen from the SSH server, commonly
127.0.0.1when the database runs on that server. - Click Test before saving.
Encrypted Profile Storage
Database profiles follow the same vault model as protected SSH Bridge resources. The desktop app encrypts the complete profile before upload. The encrypted data includes the database password, SSH tunnel credentials, engine parameters, initialization queries, saved queries, query history, and export schedules. The backend stores an authenticated user's encrypted envelope and does not receive those profile fields as readable JSON.
Vault and Account Lifecycle
Your vault must be unlocked to save or load database profiles. When you sign out, SSH Bridge closes the managed database window and its active database sessions. The database window is also tied to the parent SSH Bridge process, so it is terminated when the main desktop application exits unexpectedly.
Security Recommendations
- Use a dedicated database user with only the permissions required for the task.
- Prefer TLS and a trusted certificate for remote database connections.
- Use an SSH tunnel or private network instead of publishing a database listener to the internet.
- Keep destructive statements in explicit transactions when the engine supports them.
- Do not enable AI sample rows when query results contain sensitive data.