Setup and teardown an SSH tunnel

I have some databases that are only accessible via SSH tunnel. Right now, I have to start a tunnel in another tab or the background, then use pgcli to connect to the tunnel locally. When I’m done, I have to remember to kill the tunnel. It would be great if I could pass another argument(s) to pgcli and it would setup and teardown the tunnel for me.

I imagine something like pgcli --ssh 'ssh_user:ssh_password@ssh_host:ssh_port' 'postgresql://pg_user:pg_password@pg_host:pg_port/dbname' which would do the equivalent of:

ssh -p ssh_port -L localhost:0000:pg_host:pg_port -N ssh_user@ssh_host
psql -U pg_user -h localhost -p 0000 -d dbname

where 0000 is some random available port.

sshtunnel looks like it might be well suited to manage the tunnel. It also appears to respect settings in ssh_config(5), so pgcli users with more complicated SSH needs can configure them there.

[tsroten]

@cbandy @diddeb You can also connect via SSH without worrying about closing the tunnel via the ExitOnForwardFailure configuration option (-o). And, you can make SSH go in the background so you don’t need two tabs (-f).

I have a shell function I can call whenever I want to bind a local port to a postgres port on the SSH server. The sleep 10 means that I’ll have 10 seconds to connect to the port before the SSH connection closes automatically.

sshb_pg() {
    ssh -f -o ExitOnForwardFailure=yes -L 9432:localhost:5432 \
    $1 sleep 10
}

Usage:

$ sshb_pg ssh_user@ssh_host && pgcli [...]

Use shell aliases to do it all at once:

alias pg_ssh="sshb_pg ssh_user@ssh_host && pgcli -U pg_user -h localhost -p 9432 -d dbname"

$ pg_ssh
dbname> 

[amjith]

Thank you for the request. I’m not sure if there is enough interest for this to be built into pgcli as opposed to keeping them separate.

I’m hesitant to build this in as this has potential to cause a lot more support load. People might have different versions of paramiko or pycrypto or openssl lib etc and debugging the issues raising from that can be quite hairy.

I can keep this issue open and if I see more people interested in this, I’ll reconsider.