<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	>
<channel>
	<title>Comments on: Secure mysql replication between colos over an ssh tunnel</title>
	<atom:link href="http://www.jaisenmathai.com/blog/2008/10/10/secure-mysql-replication-between-colos-over-an-ssh-tunnel/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.jaisenmathai.com/blog/2008/10/10/secure-mysql-replication-between-colos-over-an-ssh-tunnel/</link>
	<description>A blog about killer code</description>
	<pubDate>Wed, 10 Mar 2010 01:44:56 +0000</pubDate>
	<generator>http://wordpress.org/?v=2.7</generator>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
		<item>
		<title>By: Dima</title>
		<link>http://www.jaisenmathai.com/blog/2008/10/10/secure-mysql-replication-between-colos-over-an-ssh-tunnel/comment-page-1/#comment-1231</link>
		<dc:creator>Dima</dc:creator>
		<pubDate>Sun, 07 Mar 2010 19:57:35 +0000</pubDate>
		<guid isPermaLink="false">http://www.jaisenmathai.com/blog/?p=37#comment-1231</guid>
		<description>@Justin

Great idea with using mysqladmin to check the database status!</description>
		<content:encoded><![CDATA[<p>@Justin</p>
<p>Great idea with using mysqladmin to check the database status!</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Dima</title>
		<link>http://www.jaisenmathai.com/blog/2008/10/10/secure-mysql-replication-between-colos-over-an-ssh-tunnel/comment-page-1/#comment-1230</link>
		<dc:creator>Dima</dc:creator>
		<pubDate>Sun, 07 Mar 2010 19:56:00 +0000</pubDate>
		<guid isPermaLink="false">http://www.jaisenmathai.com/blog/?p=37#comment-1230</guid>
		<description>Hi. Great article, thanks! It's been extremely helpful!

One small addition - you might probably want to add a lock file to this script, so that it can only be executed once at a time, and have it exit if the lock file already exists, otherwise you get a lot of problems if for some reason the scripts doesn't exit, due to some socket issues, and cron executes a new copy of script every minute. :)</description>
		<content:encoded><![CDATA[<p>Hi. Great article, thanks! It&#8217;s been extremely helpful!</p>
<p>One small addition - you might probably want to add a lock file to this script, so that it can only be executed once at a time, and have it exit if the lock file already exists, otherwise you get a lot of problems if for some reason the scripts doesn&#8217;t exit, due to some socket issues, and cron executes a new copy of script every minute. :)</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: JM</title>
		<link>http://www.jaisenmathai.com/blog/2008/10/10/secure-mysql-replication-between-colos-over-an-ssh-tunnel/comment-page-1/#comment-1224</link>
		<dc:creator>JM</dc:creator>
		<pubDate>Thu, 18 Feb 2010 22:51:20 +0000</pubDate>
		<guid isPermaLink="false">http://www.jaisenmathai.com/blog/?p=37#comment-1224</guid>
		<description>@Justin,

The problem with your initial script is that you have two separate SSH commands that create your two tunnels. That allows them to fail independently, so you can't use one to infer the status of the other.

If you look at the original script from Brandon's site, it forwards two ports within the same tunnel (2 -L options). Because they both are part of the same SSH, they'll either both be up or both be down, so I can use the SSH port-forward to check on the MySQL port-forward. This way, you don't need to create additional MySQL users.

Hope this simplifies things a bit.</description>
		<content:encoded><![CDATA[<p>@Justin,</p>
<p>The problem with your initial script is that you have two separate SSH commands that create your two tunnels. That allows them to fail independently, so you can&#8217;t use one to infer the status of the other.</p>
<p>If you look at the original script from Brandon&#8217;s site, it forwards two ports within the same tunnel (2 -L options). Because they both are part of the same SSH, they&#8217;ll either both be up or both be down, so I can use the SSH port-forward to check on the MySQL port-forward. This way, you don&#8217;t need to create additional MySQL users.</p>
<p>Hope this simplifies things a bit.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: jaisen</title>
		<link>http://www.jaisenmathai.com/blog/2008/10/10/secure-mysql-replication-between-colos-over-an-ssh-tunnel/comment-page-1/#comment-625</link>
		<dc:creator>jaisen</dc:creator>
		<pubDate>Thu, 02 Jul 2009 17:11:18 +0000</pubDate>
		<guid isPermaLink="false">http://www.jaisenmathai.com/blog/?p=37#comment-625</guid>
		<description>@Justin, I haven't had a chance to try out your script but it looks like a better way to verify the connection.  Thanks for sharing.</description>
		<content:encoded><![CDATA[<p>@Justin, I haven&#8217;t had a chance to try out your script but it looks like a better way to verify the connection.  Thanks for sharing.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Justin</title>
		<link>http://www.jaisenmathai.com/blog/2008/10/10/secure-mysql-replication-between-colos-over-an-ssh-tunnel/comment-page-1/#comment-624</link>
		<dc:creator>Justin</dc:creator>
		<pubDate>Thu, 02 Jul 2009 17:07:49 +0000</pubDate>
		<guid isPermaLink="false">http://www.jaisenmathai.com/blog/?p=37#comment-624</guid>
		<description>I've actually modified this a bit more.  Now, you no longer need to create the additional forwarded port to 19922.  That was used to confirm the port did exist.  However, I found it did NOT prove the forwarded 3306 port was up.

The modifications now use the actual database on the remove server to prove you still have a good connection.

In order to use this, you have to create a new user on the remote db.  That user should be named 'status_test'.  Do NOT give the user any privileges.  

&lt;pre name="code" class="sh"&gt;&gt; grant usage on *.* to status_test@'%' identified by 'my_bogus_password';&lt;/pre&gt;

Now, this user can do nothing except connect to the db and check it's status.

Here is the script : 
&lt;pre name="code" class="sh"&gt;#!/bin/bash
# Creates an SSH tunnel to allow local access to a remote mysql server.
# Call as follows : ./tunnel_setup.bsh user_name_here server_address_here remote_port_here local_port_here
# Requires ssh keys for the user running the script or the user that CRON is setup under

echo "*******************************"
echo `date`
user=$1
server=$2
remote_port=$3
local_port=$4
createTunnel() {
  /usr/bin/ssh -T -f -N -L${local_port}:127.0.0.1:${remote_port} ${user}@${server}
  if [[ $? -eq 0 ]]; then
    echo ${local_port} Tunnel to ${server} created successfully
  else
    echo An error occurred creating tunnel ${local_port} to ${server} RC was $?
  fi

}
## Run the mysqladmin status command remotely.  If it returns non-zero, then create a new connection
echo Verifying Database Connection
echo "----------------------------------"
/opt/local/bin/mysqladmin -u status_test -p my_bogus_password -h127.0.0.1 -P${local_port} status
if [[ $? -ne 0 ]]; then
  echo Creating new tunnel connection
  createTunnel
else
  echo Tunnel already exists
fi
echo "*******************************"&lt;/pre&gt;


Then, create a cron that starts this script every X minutes.  It will run the the mysqladmin status command.  If the connection does not exist, the script will automatically recreate the tunnel.

Hope this helps everyone.</description>
		<content:encoded><![CDATA[<p>I&#8217;ve actually modified this a bit more.  Now, you no longer need to create the additional forwarded port to 19922.  That was used to confirm the port did exist.  However, I found it did NOT prove the forwarded 3306 port was up.</p>
<p>The modifications now use the actual database on the remove server to prove you still have a good connection.</p>
<p>In order to use this, you have to create a new user on the remote db.  That user should be named &#8217;status_test&#8217;.  Do NOT give the user any privileges.  </p>
<pre name="code" class="sh">> grant usage on *.* to status_test@'%' identified by 'my_bogus_password';</pre>
<p>Now, this user can do nothing except connect to the db and check it&#8217;s status.</p>
<p>Here is the script : </p>
<pre name="code" class="sh">#!/bin/bash
# Creates an SSH tunnel to allow local access to a remote mysql server.
# Call as follows : ./tunnel_setup.bsh user_name_here server_address_here remote_port_here local_port_here
# Requires ssh keys for the user running the script or the user that CRON is setup under

echo "*******************************"
echo `date`
user=$1
server=$2
remote_port=$3
local_port=$4
createTunnel() {
  /usr/bin/ssh -T -f -N -L${local_port}:127.0.0.1:${remote_port} ${user}@${server}
  if [[ $? -eq 0 ]]; then
    echo ${local_port} Tunnel to ${server} created successfully
  else
    echo An error occurred creating tunnel ${local_port} to ${server} RC was $?
  fi

}
## Run the mysqladmin status command remotely.  If it returns non-zero, then create a new connection
echo Verifying Database Connection
echo "----------------------------------"
/opt/local/bin/mysqladmin -u status_test -p my_bogus_password -h127.0.0.1 -P${local_port} status
if [[ $? -ne 0 ]]; then
  echo Creating new tunnel connection
  createTunnel
else
  echo Tunnel already exists
fi
echo "*******************************"</pre>
<p>Then, create a cron that starts this script every X minutes.  It will run the the mysqladmin status command.  If the connection does not exist, the script will automatically recreate the tunnel.</p>
<p>Hope this helps everyone.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Rico</title>
		<link>http://www.jaisenmathai.com/blog/2008/10/10/secure-mysql-replication-between-colos-over-an-ssh-tunnel/comment-page-1/#comment-622</link>
		<dc:creator>Rico</dc:creator>
		<pubDate>Thu, 02 Jul 2009 16:47:51 +0000</pubDate>
		<guid isPermaLink="false">http://www.jaisenmathai.com/blog/?p=37#comment-622</guid>
		<description>Sorry.. found it. Have to use the tunnel user to login. Not another account.</description>
		<content:encoded><![CDATA[<p>Sorry.. found it. Have to use the tunnel user to login. Not another account.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Rico</title>
		<link>http://www.jaisenmathai.com/blog/2008/10/10/secure-mysql-replication-between-colos-over-an-ssh-tunnel/comment-page-1/#comment-621</link>
		<dc:creator>Rico</dc:creator>
		<pubDate>Thu, 02 Jul 2009 16:35:24 +0000</pubDate>
		<guid isPermaLink="false">http://www.jaisenmathai.com/blog/?p=37#comment-621</guid>
		<description>Hi thank you very much for sharing the knowledge. One minor issue, I don't have to login to the remote server following the steps above, but the tunnel check (ls) to localhost prompts me to login. Is there a way to fix this?</description>
		<content:encoded><![CDATA[<p>Hi thank you very much for sharing the knowledge. One minor issue, I don&#8217;t have to login to the remote server following the steps above, but the tunnel check (ls) to localhost prompts me to login. Is there a way to fix this?</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Justin</title>
		<link>http://www.jaisenmathai.com/blog/2008/10/10/secure-mysql-replication-between-colos-over-an-ssh-tunnel/comment-page-1/#comment-591</link>
		<dc:creator>Justin</dc:creator>
		<pubDate>Wed, 17 Jun 2009 03:01:52 +0000</pubDate>
		<guid isPermaLink="false">http://www.jaisenmathai.com/blog/?p=37#comment-591</guid>
		<description>I made some modifications to make this a little more portable.  This will also allow you to create multiple tunnels.

&lt;pre name="code" class="sh"&gt;#!/bin/bash
# Creates an SSH tunnel to allow local access to a remote mysql server.

echo "*******************************"
echo `date`
user=$1
server=$2
remote_port=$3
local_port=$4
createTunnel() {
  /usr/bin/ssh -T -f -N -L${local_port}:127.0.0.1:${remote_port} ${user}@${server}
  if [[ $? -eq 0 ]]; then
    echo ${local_port} Tunnel to ${server} created successfully
  else
    echo An error occurred creating tunnel ${local_port} to ${server} RC was $?
  fi

  /usr/bin/ssh -T -f -N -L19922:127.0.0.1:22 ${user}@${server}
  if [[ $? -eq 0 ]]; then
    echo L19922 Tunnel to ${server} created successfully
  else
    echo An error occurred creating tunnel L19922 to ${server} RC was $?
  fi
}
## Run the 'ls' command remotely.  If it returns non-zero, then create a new connection
echo Remote Directory Listing Verifies Connection
echo "----------------------------------"
/usr/bin/ssh -p 19922 ${user}@localhost ls
if [[ $? -ne 0 ]]; then
  echo Creating new tunnel connection
  createTunnel
else
  echo Tunnel already exists
fi
echo "*******************************"&lt;/pre&gt;

You can then cron this by calling it as follows : 

&lt;pre name="code" class="sh"&gt;./sshsetup.sh user_name_here server_address_here remote_port_here local_port_here&lt;/pre&gt;</description>
		<content:encoded><![CDATA[<p>I made some modifications to make this a little more portable.  This will also allow you to create multiple tunnels.</p>
<pre name="code" class="sh">#!/bin/bash
# Creates an SSH tunnel to allow local access to a remote mysql server.

echo "*******************************"
echo `date`
user=$1
server=$2
remote_port=$3
local_port=$4
createTunnel() {
  /usr/bin/ssh -T -f -N -L${local_port}:127.0.0.1:${remote_port} ${user}@${server}
  if [[ $? -eq 0 ]]; then
    echo ${local_port} Tunnel to ${server} created successfully
  else
    echo An error occurred creating tunnel ${local_port} to ${server} RC was $?
  fi

  /usr/bin/ssh -T -f -N -L19922:127.0.0.1:22 ${user}@${server}
  if [[ $? -eq 0 ]]; then
    echo L19922 Tunnel to ${server} created successfully
  else
    echo An error occurred creating tunnel L19922 to ${server} RC was $?
  fi
}
## Run the 'ls' command remotely.  If it returns non-zero, then create a new connection
echo Remote Directory Listing Verifies Connection
echo "----------------------------------"
/usr/bin/ssh -p 19922 ${user}@localhost ls
if [[ $? -ne 0 ]]; then
  echo Creating new tunnel connection
  createTunnel
else
  echo Tunnel already exists
fi
echo "*******************************"</pre>
<p>You can then cron this by calling it as follows : </p>
<pre name="code" class="sh">./sshsetup.sh user_name_here server_address_here remote_port_here local_port_here</pre>
]]></content:encoded>
	</item>
	<item>
		<title>By: Justin</title>
		<link>http://www.jaisenmathai.com/blog/2008/10/10/secure-mysql-replication-between-colos-over-an-ssh-tunnel/comment-page-1/#comment-590</link>
		<dc:creator>Justin</dc:creator>
		<pubDate>Wed, 17 Jun 2009 02:41:44 +0000</pubDate>
		<guid isPermaLink="false">http://www.jaisenmathai.com/blog/?p=37#comment-590</guid>
		<description>I was trying to reinvent this wheel.  I had a Yugo.  Then I came across your post.  Now, I have a Ferrari.  

Thank you!</description>
		<content:encoded><![CDATA[<p>I was trying to reinvent this wheel.  I had a Yugo.  Then I came across your post.  Now, I have a Ferrari.  </p>
<p>Thank you!</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Nick</title>
		<link>http://www.jaisenmathai.com/blog/2008/10/10/secure-mysql-replication-between-colos-over-an-ssh-tunnel/comment-page-1/#comment-326</link>
		<dc:creator>Nick</dc:creator>
		<pubDate>Thu, 19 Mar 2009 11:40:41 +0000</pubDate>
		<guid isPermaLink="false">http://www.jaisenmathai.com/blog/?p=37#comment-326</guid>
		<description>A very interesting article!</description>
		<content:encoded><![CDATA[<p>A very interesting article!</p>
]]></content:encoded>
	</item>
</channel>
</rss>
