I want to set up an SSH tunnel to my MySQL database on a remote server. Can I create an SSH user that has only the minimum permissions that are strictly necessary to access MySQL, for example with a database management application like HeidiSQL or Sequel Pro? I don't want the user to be able to access anything else.
You can add a user without a valid login shell:
# useradd -s /sbin/nologin dbuser
Set their password:
# passwd dbuser
Or leave it unset and make SSH keys:
(on local machine) $ ssh-keygen (on remote machine) # su -s /bin/bash - dbuser $ cat local_id_rsa.pub >>~/.ssh/authorized_keys
At this point, you can use SSH to create the tunnel:
ssh -TfnN -L localhost:<local_port>:localhost:<db_server_port> dbuser@remote_host
If you used SSH keys to authenticate, this will work automatically, otherwise you'll need to type in a password. ssh will go to background immediately after authenticating, and will not attempt to execute any command, but the tunnel will be open. Type 'localhost' and the <local_port> value into your local DB client, and it'll work. However:
$ ssh dbuser@remote_host dbuser@remote_host's password: Last login: Fri Oct 9 09:27:24 2015 from local_host This account is currently not available. Connection to remote_host closed.
SSH will not execute any shell or command as the remote user;
/sbin/nologin will kick it out every time.