By default, connections to the MySQL or MariaDB service via port 3306 are unencrypted, meaning that both the password and the data could be intercepted. For this reason, databases on our cPanel servers cannot be accessed directly from outside, only via an encrypted SSH tunnel. For this reason, the IP addresses specified in the cPanel Remote Database Access interface do not provide direct access.

This is an advanced topic and assumes you have some experience with SSH and SQL client programs.

Prerequisites

• SSH access: available in the cP Premium, cP Pro and cP Pro 100 cPanel hosting plans.
• SSH key: use an SSH key for secure access; the public key must be uploaded and activated on the hosting account.
• Database and user: the user must be assigned to the database with the appropriate permissions; this is covered in the article on creating MySQL databases and users. Both the database and user names begin with the cPanel username (for example, felhasznalo_webshop).

Linux, macOS, WSL and Windows PowerShell

Open a terminal, then use the following command to set up the tunnel to the cPanel hosting account:

ssh -p 4231 -N -L 3333:localhost:3306 user@server

Where:

• -p 4231: the SSH server port to which you need to connect.
• -N: the client must not run any commands or shells; it must only maintain the tunnel.
• -L 3333:localhost:3306: traffic arriving at port 3333 on the local machine is forwarded to the address localhost:3306 as seen from the server (where ‘localhost’ refers to the remote server).
• user@servere: the cPanel username and the server name.

The built-in OpenSSH client in Windows 10 and 11 accepts the same command in PowerShell. If the connection is terminated due to inactivity, add the -o ServerAliveInterval=60 switch.

Windows, PuTTY

1. In PuTTY, enter the server name and the SSH port, and in the Connection > SSH > Auth > Credentials section, enter the private key in PPK format.
2. On the Connection > SSH > Tunnels page, enter 3333 in the Source port field and localhost:3306 in the Destination field, then click the Add button.
3. Connect, and the tunnel will remain active whilst the window is open.

Configuring the SQL client

Whilst the tunnel is active, enter the following in your SQL client (e.g. HeidiSQL, DBeaver, MySQL Workbench):

• Server: 127.0.0.1 (do not enter localhost, as some clients interpret this as a local socket and will not use the tunnel),
• Port: 3333,
• Username and password: the database user’s full name and password.

The programs listed also have their own SSH tunnel functions (HeidiSQL: ‘MySQL (SSH tunnel)’, MySQL Workbench: ‘Standard TCP/IP over SSH’, DBeaver: SSH tab). In this case, no separate command is required: in the SSH section, enter the server name, port, cPanel username and key; in the database section, enter the address 127.0.0.1 and port 3306.

Common errors

• Permission denied (public key): the key is not authorised in the cPanel SSH Access interface, or you are not using the correct private key.
• Address already in use: port 3333 is already in use on your machine; please choose another one (for example, 3334:localhost:3306).
• Access denied for user: the ‘cPanel’ prefix is missing from the start of the username, or the user is not assigned to the database.