Secure remote connection to the MySQL server

An unencrypted remote MySQL connection can expose the credentials and the data exchanged. An SSH tunnel encrypts the leg between your computer and the server without needing to authorise your computer's IP directly in MySQL. The tunnel does not close the managed service's public port.

This guide uses the SSH tunnel available on plans with SSH access. Before continuing, enable and set up SSH access with an Ed25519 key protected by a passphrase.

Connecting from a MySQL client with SSH support

If your database client includes SSH support, it can create the tunnel automatically. When you create the connection, configure the SSH and MySQL tabs separately.

In the SSH settings, enter:

• SSH server: the server name shown in your hosting's technical details. Avoid a domain behind a proxy or one pointing to another provider
• SSH port: 93, unless your service details say otherwise
• SSH user: your cPanel username
• Authentication: Ed25519 private key
• Private key: the local path of the key whose public part you authorised in cPanel

Protect the key with a passphrase and use the key agent or the client's secure store to unlock it. Do not save the cPanel password in the connection.

In the MySQL settings, enter:

• MySQL server: 127.0.0.1
• MySQL port: 3306
• MySQL user and password: those of a user limited to the database you need
• Database: the full name created in cPanel

The client will first open the SSH session and, inside that tunnel, connect to MySQL on 127.0.0.1. Before accepting the first SSH connection, check the server's fingerprint as explained in the linked guide.

Create the tunnel from your computer's terminal

You can also open it with OpenSSH. This command runs on your computer, not inside the hosting. Replace the server, user and key path:

ssh -N -T -p 93 -i ~/.ssh/id_ed25519 \
  -o ExitOnForwardFailure=yes \
  -L 127.0.0.1:13306:127.0.0.1:3306 \
  usuario_cpanel@servidor.example.com

The terminal stays open without showing a remote shell. While it stays connected, set up your MySQL client with host 127.0.0.1, port 13306 and the database user and password. In this case, do not also turn on the client's built-in tunnel.

Listening is limited to your own computer. Do not replace 127.0.0.1 with 0.0.0.0, which could let other computers on the network use the tunnel. When you finish, close the MySQL connection and press Ctrl+C in the tunnel's terminal.

If it does not connect

• Address already in use: local port 13306 is taken. Choose another free local port and use that same number in the MySQL client.
• Permission denied (publickey): check the SSH user, the chosen key and that its public part is authorised in the account.
• Administratively prohibited: the server is refusing the forwarding. Ask support whether that account allows tunnels; enabling SSH does not mean every kind of forwarding is allowed.
• MySQL Access denied: the tunnel may be working. Check the MySQL credentials and the user's assignment to the database, which are separate from SSH.
• Server fingerprint error: confirm the change with support before replacing the saved fingerprint.

SSH encryption protects the leg up to the SSH server. This example connects from there to the local MySQL; if the destination were another server, you would also need to assess and protect that leg.