<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: Secure mysql replication between colos over an ssh tunnel</title>
	<atom:link href="http://www.jaisenmathai.com/blog/2008/10/10/secure-mysql-replication-between-colos-over-an-ssh-tunnel/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.jaisenmathai.com/blog/2008/10/10/secure-mysql-replication-between-colos-over-an-ssh-tunnel/</link>
	<description>A blog about killer code</description>
	<lastBuildDate>Thu, 29 Jul 2010 17:11:21 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9.2</generator>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
		<item>
		<title>By: Dima</title>
		<link>http://www.jaisenmathai.com/blog/2008/10/10/secure-mysql-replication-between-colos-over-an-ssh-tunnel/comment-page-1/#comment-1231</link>
		<dc:creator>Dima</dc:creator>
		<pubDate>Sun, 07 Mar 2010 19:57:35 +0000</pubDate>
		<guid isPermaLink="false">http://www.jaisenmathai.com/blog/?p=37#comment-1231</guid>
		<description>@Justin

Great idea with using mysqladmin to check the database status!</description>
		<content:encoded><![CDATA[<p>@Justin</p>
<p>Great idea with using mysqladmin to check the database status!</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Dima</title>
		<link>http://www.jaisenmathai.com/blog/2008/10/10/secure-mysql-replication-between-colos-over-an-ssh-tunnel/comment-page-1/#comment-1230</link>
		<dc:creator>Dima</dc:creator>
		<pubDate>Sun, 07 Mar 2010 19:56:00 +0000</pubDate>
		<guid isPermaLink="false">http://www.jaisenmathai.com/blog/?p=37#comment-1230</guid>
		<description>Hi. Great article, thanks! It&#039;s been extremely helpful!

One small addition - you might probably want to add a lock file to this script, so that it can only be executed once at a time, and have it exit if the lock file already exists, otherwise you get a lot of problems if for some reason the scripts doesn&#039;t exit, due to some socket issues, and cron executes a new copy of script every minute. :)</description>
		<content:encoded><![CDATA[<p>Hi. Great article, thanks! It&#8217;s been extremely helpful!</p>
<p>One small addition &#8211; you might probably want to add a lock file to this script, so that it can only be executed once at a time, and have it exit if the lock file already exists, otherwise you get a lot of problems if for some reason the scripts doesn&#8217;t exit, due to some socket issues, and cron executes a new copy of script every minute. :)</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: JM</title>
		<link>http://www.jaisenmathai.com/blog/2008/10/10/secure-mysql-replication-between-colos-over-an-ssh-tunnel/comment-page-1/#comment-1224</link>
		<dc:creator>JM</dc:creator>
		<pubDate>Thu, 18 Feb 2010 22:51:20 +0000</pubDate>
		<guid isPermaLink="false">http://www.jaisenmathai.com/blog/?p=37#comment-1224</guid>
		<description>@Justin,

The problem with your initial script is that you have two separate SSH commands that create your two tunnels. That allows them to fail independently, so you can&#039;t use one to infer the status of the other.

If you look at the original script from Brandon&#039;s site, it forwards two ports within the same tunnel (2 -L options). Because they both are part of the same SSH, they&#039;ll either both be up or both be down, so I can use the SSH port-forward to check on the MySQL port-forward. This way, you don&#039;t need to create additional MySQL users.

Hope this simplifies things a bit.</description>
		<content:encoded><![CDATA[<p>@Justin,</p>
<p>The problem with your initial script is that you have two separate SSH commands that create your two tunnels. That allows them to fail independently, so you can&#8217;t use one to infer the status of the other.</p>
<p>If you look at the original script from Brandon&#8217;s site, it forwards two ports within the same tunnel (2 -L options). Because they both are part of the same SSH, they&#8217;ll either both be up or both be down, so I can use the SSH port-forward to check on the MySQL port-forward. This way, you don&#8217;t need to create additional MySQL users.</p>
<p>Hope this simplifies things a bit.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: jaisen</title>
		<link>http://www.jaisenmathai.com/blog/2008/10/10/secure-mysql-replication-between-colos-over-an-ssh-tunnel/comment-page-1/#comment-625</link>
		<dc:creator>jaisen</dc:creator>
		<pubDate>Thu, 02 Jul 2009 17:11:18 +0000</pubDate>
		<guid isPermaLink="false">http://www.jaisenmathai.com/blog/?p=37#comment-625</guid>
		<description>@Justin, I haven&#039;t had a chance to try out your script but it looks like a better way to verify the connection.  Thanks for sharing.</description>
		<content:encoded><![CDATA[<p>@Justin, I haven&#8217;t had a chance to try out your script but it looks like a better way to verify the connection.  Thanks for sharing.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Justin</title>
		<link>http://www.jaisenmathai.com/blog/2008/10/10/secure-mysql-replication-between-colos-over-an-ssh-tunnel/comment-page-1/#comment-624</link>
		<dc:creator>Justin</dc:creator>
		<pubDate>Thu, 02 Jul 2009 17:07:49 +0000</pubDate>
		<guid isPermaLink="false">http://www.jaisenmathai.com/blog/?p=37#comment-624</guid>
		<description>I&#039;ve actually modified this a bit more.  Now, you no longer need to create the additional forwarded port to 19922.  That was used to confirm the port did exist.  However, I found it did NOT prove the forwarded 3306 port was up.

The modifications now use the actual database on the remove server to prove you still have a good connection.

In order to use this, you have to create a new user on the remote db.  That user should be named &#039;status_test&#039;.  Do NOT give the user any privileges.  

&lt;pre name=&quot;code&quot; class=&quot;sh&quot;&gt;&gt; grant usage on *.* to status_test@&#039;%&#039; identified by &#039;my_bogus_password&#039;;&lt;/pre&gt;

Now, this user can do nothing except connect to the db and check it&#039;s status.

Here is the script : 
&lt;pre name=&quot;code&quot; class=&quot;sh&quot;&gt;#!/bin/bash
# Creates an SSH tunnel to allow local access to a remote mysql server.
# Call as follows : ./tunnel_setup.bsh user_name_here server_address_here remote_port_here local_port_here
# Requires ssh keys for the user running the script or the user that CRON is setup under

echo &quot;*******************************&quot;
echo `date`
user=$1
server=$2
remote_port=$3
local_port=$4
createTunnel() {
  /usr/bin/ssh -T -f -N -L${local_port}:127.0.0.1:${remote_port} ${user}@${server}
  if [[ $? -eq 0 ]]; then
    echo ${local_port} Tunnel to ${server} created successfully
  else
    echo An error occurred creating tunnel ${local_port} to ${server} RC was $?
  fi

}
## Run the mysqladmin status command remotely.  If it returns non-zero, then create a new connection
echo Verifying Database Connection
echo &quot;----------------------------------&quot;
/opt/local/bin/mysqladmin -u status_test -p my_bogus_password -h127.0.0.1 -P${local_port} status
if [[ $? -ne 0 ]]; then
  echo Creating new tunnel connection
  createTunnel
else
  echo Tunnel already exists
fi
echo &quot;*******************************&quot;&lt;/pre&gt;


Then, create a cron that starts this script every X minutes.  It will run the the mysqladmin status command.  If the connection does not exist, the script will automatically recreate the tunnel.

Hope this helps everyone.</description>
		<content:encoded><![CDATA[<p>I&#8217;ve actually modified this a bit more.  Now, you no longer need to create the additional forwarded port to 19922.  That was used to confirm the port did exist.  However, I found it did NOT prove the forwarded 3306 port was up.</p>
<p>The modifications now use the actual database on the remove server to prove you still have a good connection.</p>
<p>In order to use this, you have to create a new user on the remote db.  That user should be named &#8217;status_test&#8217;.  Do NOT give the user any privileges.  </p>
<pre name="code" class="sh">> grant usage on *.* to status_test@'%' identified by 'my_bogus_password';</pre>
<p>Now, this user can do nothing except connect to the db and check it&#8217;s status.</p>
<p>Here is the script : </p>
<pre name="code" class="sh">#!/bin/bash
# Creates an SSH tunnel to allow local access to a remote mysql server.
# Call as follows : ./tunnel_setup.bsh user_name_here server_address_here remote_port_here local_port_here
# Requires ssh keys for the user running the script or the user that CRON is setup under

echo "*******************************"
echo `date`
user=$1
server=$2
remote_port=$3
local_port=$4
createTunnel() {
  /usr/bin/ssh -T -f -N -L${local_port}:127.0.0.1:${remote_port} ${user}@${server}
  if [[ $? -eq 0 ]]; then
    echo ${local_port} Tunnel to ${server} created successfully
  else
    echo An error occurred creating tunnel ${local_port} to ${server} RC was $?
  fi

}
## Run the mysqladmin status command remotely.  If it returns non-zero, then create a new connection
echo Verifying Database Connection
echo "----------------------------------"
/opt/local/bin/mysqladmin -u status_test -p my_bogus_password -h127.0.0.1 -P${local_port} status
if [[ $? -ne 0 ]]; then
  echo Creating new tunnel connection
  createTunnel
else
  echo Tunnel already exists
fi
echo "*******************************"</pre>
<p>Then, create a cron that starts this script every X minutes.  It will run the the mysqladmin status command.  If the connection does not exist, the script will automatically recreate the tunnel.</p>
<p>Hope this helps everyone.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Rico</title>
		<link>http://www.jaisenmathai.com/blog/2008/10/10/secure-mysql-replication-between-colos-over-an-ssh-tunnel/comment-page-1/#comment-622</link>
		<dc:creator>Rico</dc:creator>
		<pubDate>Thu, 02 Jul 2009 16:47:51 +0000</pubDate>
		<guid isPermaLink="false">http://www.jaisenmathai.com/blog/?p=37#comment-622</guid>
		<description>Sorry.. found it. Have to use the tunnel user to login. Not another account.</description>
		<content:encoded><![CDATA[<p>Sorry.. found it. Have to use the tunnel user to login. Not another account.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Rico</title>
		<link>http://www.jaisenmathai.com/blog/2008/10/10/secure-mysql-replication-between-colos-over-an-ssh-tunnel/comment-page-1/#comment-621</link>
		<dc:creator>Rico</dc:creator>
		<pubDate>Thu, 02 Jul 2009 16:35:24 +0000</pubDate>
		<guid isPermaLink="false">http://www.jaisenmathai.com/blog/?p=37#comment-621</guid>
		<description>Hi thank you very much for sharing the knowledge. One minor issue, I don&#039;t have to login to the remote server following the steps above, but the tunnel check (ls) to localhost prompts me to login. Is there a way to fix this?</description>
		<content:encoded><![CDATA[<p>Hi thank you very much for sharing the knowledge. One minor issue, I don&#8217;t have to login to the remote server following the steps above, but the tunnel check (ls) to localhost prompts me to login. Is there a way to fix this?</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Justin</title>
		<link>http://www.jaisenmathai.com/blog/2008/10/10/secure-mysql-replication-between-colos-over-an-ssh-tunnel/comment-page-1/#comment-591</link>
		<dc:creator>Justin</dc:creator>
		<pubDate>Wed, 17 Jun 2009 03:01:52 +0000</pubDate>
		<guid isPermaLink="false">http://www.jaisenmathai.com/blog/?p=37#comment-591</guid>
		<description>I made some modifications to make this a little more portable.  This will also allow you to create multiple tunnels.

&lt;pre name=&quot;code&quot; class=&quot;sh&quot;&gt;#!/bin/bash
# Creates an SSH tunnel to allow local access to a remote mysql server.

echo &quot;*******************************&quot;
echo `date`
user=$1
server=$2
remote_port=$3
local_port=$4
createTunnel() {
  /usr/bin/ssh -T -f -N -L${local_port}:127.0.0.1:${remote_port} ${user}@${server}
  if [[ $? -eq 0 ]]; then
    echo ${local_port} Tunnel to ${server} created successfully
  else
    echo An error occurred creating tunnel ${local_port} to ${server} RC was $?
  fi

  /usr/bin/ssh -T -f -N -L19922:127.0.0.1:22 ${user}@${server}
  if [[ $? -eq 0 ]]; then
    echo L19922 Tunnel to ${server} created successfully
  else
    echo An error occurred creating tunnel L19922 to ${server} RC was $?
  fi
}
## Run the &#039;ls&#039; command remotely.  If it returns non-zero, then create a new connection
echo Remote Directory Listing Verifies Connection
echo &quot;----------------------------------&quot;
/usr/bin/ssh -p 19922 ${user}@localhost ls
if [[ $? -ne 0 ]]; then
  echo Creating new tunnel connection
  createTunnel
else
  echo Tunnel already exists
fi
echo &quot;*******************************&quot;&lt;/pre&gt;

You can then cron this by calling it as follows : 

&lt;pre name=&quot;code&quot; class=&quot;sh&quot;&gt;./sshsetup.sh user_name_here server_address_here remote_port_here local_port_here&lt;/pre&gt;</description>
		<content:encoded><![CDATA[<p>I made some modifications to make this a little more portable.  This will also allow you to create multiple tunnels.</p>
<pre name="code" class="sh">#!/bin/bash
# Creates an SSH tunnel to allow local access to a remote mysql server.

echo "*******************************"
echo `date`
user=$1
server=$2
remote_port=$3
local_port=$4
createTunnel() {
  /usr/bin/ssh -T -f -N -L${local_port}:127.0.0.1:${remote_port} ${user}@${server}
  if [[ $? -eq 0 ]]; then
    echo ${local_port} Tunnel to ${server} created successfully
  else
    echo An error occurred creating tunnel ${local_port} to ${server} RC was $?
  fi

  /usr/bin/ssh -T -f -N -L19922:127.0.0.1:22 ${user}@${server}
  if [[ $? -eq 0 ]]; then
    echo L19922 Tunnel to ${server} created successfully
  else
    echo An error occurred creating tunnel L19922 to ${server} RC was $?
  fi
}
## Run the 'ls' command remotely.  If it returns non-zero, then create a new connection
echo Remote Directory Listing Verifies Connection
echo "----------------------------------"
/usr/bin/ssh -p 19922 ${user}@localhost ls
if [[ $? -ne 0 ]]; then
  echo Creating new tunnel connection
  createTunnel
else
  echo Tunnel already exists
fi
echo "*******************************"</pre>
<p>You can then cron this by calling it as follows : </p>
<pre name="code" class="sh">./sshsetup.sh user_name_here server_address_here remote_port_here local_port_here</pre>
]]></content:encoded>
	</item>
	<item>
		<title>By: Justin</title>
		<link>http://www.jaisenmathai.com/blog/2008/10/10/secure-mysql-replication-between-colos-over-an-ssh-tunnel/comment-page-1/#comment-590</link>
		<dc:creator>Justin</dc:creator>
		<pubDate>Wed, 17 Jun 2009 02:41:44 +0000</pubDate>
		<guid isPermaLink="false">http://www.jaisenmathai.com/blog/?p=37#comment-590</guid>
		<description>I was trying to reinvent this wheel.  I had a Yugo.  Then I came across your post.  Now, I have a Ferrari.  

Thank you!</description>
		<content:encoded><![CDATA[<p>I was trying to reinvent this wheel.  I had a Yugo.  Then I came across your post.  Now, I have a Ferrari.  </p>
<p>Thank you!</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Nick</title>
		<link>http://www.jaisenmathai.com/blog/2008/10/10/secure-mysql-replication-between-colos-over-an-ssh-tunnel/comment-page-1/#comment-326</link>
		<dc:creator>Nick</dc:creator>
		<pubDate>Thu, 19 Mar 2009 11:40:41 +0000</pubDate>
		<guid isPermaLink="false">http://www.jaisenmathai.com/blog/?p=37#comment-326</guid>
		<description>A very interesting article!</description>
		<content:encoded><![CDATA[<p>A very interesting article!</p>
]]></content:encoded>
	</item>
</channel>
</rss>
