Databases

For PostgreSQL, MySQL, MSSQL and Redis records the server opens a port. Your tools connect to that port as if they were talking to the database directly; quickssh sets up the VPN and the tunnel.

Adding a record

Pick the database type from the New menu. Enter the target address, port, user and (optionally) the database name; choose the route.

quickssh add-ssh sales --db postgres --host 10.20.0.9 -u report --database sales --vpn acme
quickssh add-ssh cache --db redis --host 10.20.0.12 -u "" --vpn acme

The record gets a fixed port that doesn't change:

Type	`--db`	First port
PostgreSQL	`postgres`	15432
MySQL	`mysql`	13306
MSSQL	`mssql`	11433
Redis	`redis`	16379

If the port is taken, the next free one is used. Use --local-port to choose it yourself.

Opening the port

Press Open the port on the record page, or double-click the record.

quickssh db open sales
quickssh db ls
quickssh db close sales

Once the port is open, the Connection details card shows host, port, user and ready-made connection strings (URL, JDBC, command line) to copy. The port stays open until you close it or the server stops; closing the interface doesn't close it.

postgresql://[email protected]:15432/sales
jdbc:postgresql://127.0.0.1:15432/sales
psql -h 127.0.0.1 -p 15432 -U report sales

How it works

The server forwards every connection on the port to the target along the record's route: directly, through the VPN's proxy or through an SSH session.
If the VPN on the route is stopped or sleeping, it starts by itself on the first connection.
If you change the target or the route, new connections use the new one; you don't need to close and reopen the port.

Note: Traffic is carried as is. Your tool sends the database user name and password. The password you write into the record is only stored and can be copied from the connection details.

TLS and certificate name

Because your tool connects to 127.0.0.1, TLS settings that verify the server name (verify-full in PostgreSQL, the default in MSSQL) fail with a name mismatch. Keep encryption on and turn off name verification; that's why the MSSQL examples come with TrustServerCertificate=True.

On a central server

The port is opened on the server for you alone and only accepts connections from your current IP address. The server's address is shown as the host. If your IP changes, close the port and open it again. If your account is locked, closed or your permission is removed, the port closes too.