Support SSH Tunnel for Database Connection

[Diluka]

It would be great if dbhub could support connecting to databases via SSH tunnels. This feature is particularly helpful in environments where databases are not directly accessible due to firewall restrictions or when enhanced security is required.

[tianzhou]

Implemented in e431ffc

Please upgrade to 0.11.0 or above

[Diluka]

Does it support reading .ssh/config or ssh jump?

[tianzhou]

implemented in 22342dd

Please upgrade to 0.11.1 or above

[Diluka]

Does it support running on Windows? It looks like it's not reading my ssh config configuration. Also, my .ssh directory is a directory link.

I provided the parameter --ssh-host:

Fatal error: Error: SSH tunnel configuration requires at least --ssh-host and --ssh-user

I provided the parameters --ssh-host and --ssh-user

Fatal error: Error: SSH tunnel configuration requires either --ssh-password or --ssh-key for authentication

[tianzhou]

I haven't tested it on windows. Could you please paste the full log, in particular, I would like to see if it actually reads from the file.

[Diluka]

{
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@bytebase/dbhub@latest"],
      "env": {
        "READONLY": "true",
        "DSN": "mysql://*********",
        "SSH_HOST": "*******",
        "SSH_USER": "********",
        "SSH_KEY": "*********"
      }
    }

2025-07-22 15:12:29.578 [warning] [server stderr] Connecting with DSN: mysql://*********:*******@*********:3306/*********
2025-07-22 15:12:29.579 [warning] [server stderr] DSN source: environment variable
2025-07-22 15:12:29.579 [warning] [server stderr] SSH tunnel configuration loaded from SSH_HOST from environment, SSH_USER from environment, SSH_KEY from environment
2025-07-22 15:12:30.978 [info] Waiting for server to respond to `initialize` request...
2025-07-22 15:12:35.178 [warning] [server stderr] SSH connection established
2025-07-22 15:12:35.180 [warning] [server stderr] SSH tunnel established: localhost:53238 -> *********:3306
2025-07-22 15:12:35.180 [warning] [server stderr] Database connection will use SSH tunnel through localhost:53238
2025-07-22 15:12:35.983 [info] Waiting for server to respond to `initialize` request...
2025-07-22 15:12:37.178 [warning] [server stderr] Successfully connected to MySQL database
2025-07-22 15:12:37.179 [warning] [server stderr] Using transport: stdio
2025-07-22 15:12:37.179 [warning] [server stderr] Transport source: default
2025-07-22 15:12:37.179 [warning] [server stderr] Running in READ-ONLY mode - only read only queries allowed
2025-07-22 15:12:37.179 [warning] [server stderr] 
2025-07-22 15:12:37.179 [warning] [server stderr]  _____  ____  _   _       _
2025-07-22 15:12:37.179 [warning] [server stderr] |  __ \|  _ \| | | |     | |
2025-07-22 15:12:37.179 [warning] [server stderr] | |  | | |_) | |_| |_   _| |__
2025-07-22 15:12:37.179 [warning] [server stderr] | |  | |  _ <|  _  | | | | '_ \
2025-07-22 15:12:37.179 [warning] [server stderr] | |__| | |_) | | | | |_| | |_) |
2025-07-22 15:12:37.179 [warning] [server stderr] |_____/|____/|_| |_|\__,_|_.__/
2025-07-22 15:12:37.180 [warning] [server stderr] 
2025-07-22 15:12:37.180 [warning] [server stderr] v0.11.1 [READ-ONLY] - Universal Database MCP Server
2025-07-22 15:12:37.180 [warning] [server stderr] 
2025-07-22 15:12:37.180 [warning] [server stderr] Starting with STDIO transport

[Diluka]

Is it possible to add a configuration item to manually specify the .ssh directory location?

[tianzhou]

So from the log, it seems to be working by passing the SSH_HOST/SSH_USER/SSH_KEY directly. What's the error you see by reading from .ssh/config?

[tianzhou]

@Diluka may I know the specific use case of specifying a custom ssh directory? I want to avoid introducing options is possible.

[Diluka]

So from the log, it seems to be working by passing the SSH_HOST/SSH_USER/SSH_KEY directly. What's the error you see by reading from .ssh/config?

When I only configure SSH_HOST, I can connect if the ssh configuration file can be read correctly. But it seems that the configuration file is not read.

{
      "env": {
        "READONLY": "true",
        "DSN": "mysql://*",
        "SSH_HOST": "*****"
      }
}

2025-07-22 16:41:43.043 [warning] [server stderr] Connecting with DSN: mysql://root:*******@localhost:3306/****
2025-07-22 16:41:43.043 [warning] [server stderr] DSN source: environment variable
2025-07-22 16:41:43.047 [warning] [server stderr] Fatal error: Error: SSH tunnel configuration requires at least --ssh-host and --ssh-user
2025-07-22 16:41:43.048 [warning] [server stderr]     at resolveSSHConfig (file:///E:/Caches/npm-cache/_npx/d622e0cd94113b69/node_modules/@bytebase/dbhub/dist/index.js:2311:11)
2025-07-22 16:41:43.048 [warning] [server stderr]     at ConnectorManager.connectWithDSN (file:///E:/Caches/npm-cache/_npx/d622e0cd94113b69/node_modules/@bytebase/dbhub/dist/index.js:2339:23)
2025-07-22 16:41:43.048 [warning] [server stderr]     at main (file:///E:/Caches/npm-cache/_npx/d622e0cd94113b69/node_modules/@bytebase/dbhub/dist/index.js:3361:30)
2025-07-22 16:41:43.048 [warning] [server stderr]     at file:///E:/Caches/npm-cache/_npx/d622e0cd94113b69/node_modules/@bytebase/dbhub/dist/index.js:3444:1
2025-07-22 16:41:43.048 [warning] [server stderr]     at ModuleJob.run (node:internal/modules/esm/module_job:329:25)
2025-07-22 16:41:43.049 [warning] [server stderr]     at async onImport.tracePromise.__proto__ (node:internal/modules/esm/loader:644:26)
2025-07-22 16:41:43.049 [warning] [server stderr]     at async asyncRunEntryPointWithESMLoader (node:internal/modules/run_main:117:5)

@Diluka may I know the specific use case of specifying a custom ssh directory? I want to avoid introducing options is possible.

I'm just guessing that in the Windows environment, it doesn't know what the .ssh configuration file path is, so it doesn't read it.