{"id":4989,"date":"2021-09-14T08:41:55","date_gmt":"2021-09-14T07:41:55","guid":{"rendered":"http:\/\/dasini.net\/blog\/?p=4989"},"modified":"2021-09-21T08:40:45","modified_gmt":"2021-09-21T07:40:45","slug":"discovering-mysql-database-service-episode-7-use-a-bastion-ssh-port-forwarding-session","status":"publish","type":"post","link":"https:\/\/dasini.net\/blog\/2021\/09\/14\/discovering-mysql-database-service-episode-7-use-a-bastion-ssh-port-forwarding-session\/","title":{"rendered":"Discovering MySQL Database Service \u2013 Episode 7 \u2013 Use a Bastion SSH port forwarding session"},"content":{"rendered":"\n

MySQL<\/a>, the world’s most popular open source database<\/strong>, is available as a managed cloud service<\/strong> in Oracle Cloud Infrastructure<\/a><\/strong> (OCI<\/a><\/strong>) under the name of MySQL Database Service<\/a><\/strong> (MDS<\/a><\/strong>).<\/p>\n\n\n\n

MySQL Database Service is a fully managed cloud service, 100% Developed, Managed and Supported by the MySQL Team.<\/strong><\/p><\/blockquote><\/figure>\n\n\n\n

This is the seventh<\/span> episode of \u00ab\u00a0Discovering MySQL Database Service<\/a><\/em><\/strong><\/em><\/strong>\u00ab\u00a0, a series of tutorials where I will show you, step by step, how to use MySQL Database Service and some other Oracle Cloud Infrastructure services. <\/p>\n\n\n\n

Please also note that you can run this tutorial and thus try MySQL Database Service & the other Oracle Cloud Infrastructure services for free<\/span><\/strong> by starting your 30-day trial<\/a>.<\/p>\n\n\n\n

\"MySQL<\/figure><\/div>\n\n\n\n
\n

Planning episodes<\/h2>\n\n\n\n
  1. Introduction to the series Discovering MySQL Database Service<\/em><\/strong><\/a> <\/li>
  2. Create a compartment<\/a><\/li>
  3. Create a Virtual Cloud Network<\/a><\/li>
  4. Dump your MySQL data into an Object Storage bucket<\/a><\/li>
  5. Create a MySQL DB system from a MySQL Shell dump<\/a><\/li>
  6. Update the Private Subnet Security List<\/a><\/li>
  7. Use a Bastion SSH port forwarding session<\/a><\/li>
  8. Connect to MySQL Database Service Using MySQL Shell<\/a><\/li>
  9. Connect to MySQL Database Service Using MySQL Workbench<\/a><\/li>
  10. Connect to MySQL Database Service Using OCI Cloud Shell<\/a><\/li>
  11. MySQL Database Service Features Overview<\/li><\/ol>\n<\/div><\/div>\n\n\n\n

    <\/p>\n\n\n\n

    <\/div>\n\n\n\n

    Episode 7 – Use a Bastion SSH port forwarding session<\/h1>\n\n\n\n

    In the previous episode<\/a> we’ve seen how to allow traffic from the VCN to the MySQL Database Service instance on ports 3306 & 33060.
    One more step to our Discovering MySQL Database Service<\/em><\/strong> journey. <\/p>\n\n\n\n

    In this episode, we’ll discover and use the OCI Bastion service<\/a> to provide a restricted and time-limited access to administer our MySQL instance.<\/p>\n\n\n\n

    <\/div>\n\n\n\n

    Bastion<\/h2>\n\n\n\n

    Oracle Cloud Infrastructure Bastion provides restricted and time-limited access to target resources that don’t have public endpoints.<\/p>\n\n\n\n

    Bastions let authorized users connect from specific IP addresses to target resources using Secure Shell (SSH) sessions. When connected, users can interact with the target resource by using any software or protocol supported by SSH. <\/p>\n\n\n\n

    \"\"\/<\/figure>\n\n\n\n
    <\/div>\n\n\n\n

    So, Bastions are logical entities that provide secured, public access to target resources in the cloud that you cannot otherwise reach from the internet.
    Bastions reside in a public subnet<\/span> and establish the network infrastructure needed to connect a user to a target resource in a private subnet<\/span>. <\/p>\n\n\n\n

    Another important concept is Bastion sessions<\/a><\/strong>.
    Bastion sessions let authorized users in possession of the private key in an SSH key pair connect to a target resource for a predetermined amount of time.
    You provide the public key in the SSH key pair at the time you create the session, and then supply the private key when you connect<\/strong>.
    In addition to presenting the private key, an authorized user must also attempt the SSH connection to the target resource from an IP address within the range allowed by the bastion’s client CIDR block allowlist.<\/p>\n\n\n\n

    There are 2 kind of session types<\/a>, managed ssh session<\/strong> and ssh port forwarding session<\/strong>. In this article, we’re going to use only the ssh port forwarding session<\/span>.
    Port forwarding (also known as SSH tunneling<\/strong>) creates a secure connection between a specific port on the client machine and a specific port on the target resource.
    Using this connection you can relay other protocols.<\/p>\n\n\n\n

    Note<\/span>
    Your OCI user must be part of a group that has the right privileges in order to use all Bastion features.
    At least the following rules:
    Allow group SecurityAdmins to manage bastion-family in tenancy
    Allow group SecurityAdmins to manage virtual-network-family in tenancy
    Allow group SecurityAdmins to read instance-family in tenancy
    Allow group SecurityAdmins to read instance-agent-plugins in tenancy
    Allow group SecurityAdmins to inspect work-requests in tenancy
    Please see:     Bastion IAM Policies<\/a> and Required IAM policy to managing Bastions<\/a><\/em><\/p>\n\n\n\n

    <\/div>\n\n\n\n

    Create a bastion<\/h2>\n\n\n\n

    Go to the OCI console, in the menu, go to: Identity & Security<\/span><\/em> \/ Bastion<\/span><\/em><\/p>\n\n\n\n

    Check that you are in the right compartment and click Create Bastion<\/span><\/em> <\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n
    <\/div>\n\n\n\n

    You should provide:<\/p>\n\n\n\n