I want to set up an SSH tunnel to my MySQL database on a remote server. Can I create an SSH user that has only the minimum permissions that are strictly necessary to access MySQL, for example with a database management application like HeidiSQL or Sequel Pro? I don't want the user to be able to access anything else.
You can add a user without a valid login shell:
Set their password:
Or leave it unset and make SSH keys:
At this point, you can use SSH to create the tunnel:
If you used SSH keys to authenticate, this will work automatically, otherwise you'll need to type in a password. ssh will go to background immediately after authenticating, and will not attempt to execute any command, but the tunnel will be open. Type 'localhost' and the <local_port> value into your local DB client, and it'll work. However:
SSH will not execute any shell or command as the remote user;