iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Run replication through a loopback-only SSH tunnel instead of exposing MySQL port 3306. Use a dedicated key and locked-down operating-system account for the tunnel, restrict SSH and database firewall rules to the two VPS addresses, create a least-privilege MySQL replication account, and continuously verify tunnel health, replication state, lag, and log protection. Native MySQL TLS is the better choice when you need X.509 identity validation or centrally managed TLS policy; SSH and TLS can also be combined.
What a secure SSH replication design looks like
In the recommended topology, the replica’s MySQL process connects only to a local TCP port. An SSH client on the replica forwards that port to MySQL on the source VPS. The source database listens on loopback (or a private interface), not on its public address.
Replica mysqld > 127.0.0.1:13306
SSH local forward over the VPS network
Source mysqld < 127.0.0.1:3306The example uses local port 13306 so it cannot be confused with the normal MySQL port. The public source address in the commands below, 198.51.100.10, is a documentation-only TEST-NET address; substitute the fixed address of your source VPS. Keep the source’s real MySQL port private even though SSH port 22 must be reachable from the replica.
- Transport: SSH encrypts the TCP stream between the VPSs.
- Authentication: a separate Ed25519 key authenticates the tunnel account; host-key checking authenticates the SSH endpoint.
- Database authorization: a dedicated MySQL account receives only the replication privileges required by the installed MySQL release.
- Network boundary: the source firewall permits SSH only from the replica and does not permit public access to port 3306.
- Operations: a service manager restarts the tunnel and monitoring alerts when it is down or replication lag grows.
Prerequisites and decisions to make first
Fix the addresses and roles
Record the source VPS address, replica VPS address, SSH port, MySQL version on both servers, and the replication channel name if you use more than one channel. Stable addresses are important because firewall rules and SSH access controls should name one known peer rather than an entire internet range. If your provider offers a private network, use its addresses for the tunnel and firewall rules while retaining public SSH only where your administration policy requires it.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Choose the MySQL syntax for your release
MySQL 8.0.23 and later use CHANGE REPLICATION SOURCE TO. Older releases use the deprecated CHANGE MASTER TO terminology and may expose status and start commands under the older names as well. Do not mix syntax from different release families; check the server’s exact version before applying replication commands.
Define what SSH does not provide
SSH supplies an encrypted TCP path and authenticates the SSH host with its host key. It does not give the MySQL client an X.509 identity for the database server. If your policy requires certificate-based server or mutual authentication, explicit TLS protocol restrictions, or a transport security policy independent of SSH, configure native MySQL TLS. SSH can still be retained as an additional network boundary, but operating both layers increases configuration and troubleshooting work.
Step 1: Create a dedicated, restricted SSH tunnel account
Create the account on the source VPS
Create an operating-system account used only for forwarding. Give it no interactive shell and no administrative group membership. On distributions that provide it, /usr/sbin/nologin is suitable for an account that should not obtain a shell.
sudo useradd --system --home /var/empty --shell /usr/sbin/nologin repl-tunnel
sudo install -d -m 0700 -o repl-tunnel -g repl-tunnel /home/repl-tunnel/.sshThe home-directory path is illustrative; use the path your distribution assigns to the account. Do not place database passwords in this account’s shell profile or command history.
Generate the key on the replica
Store the private key in a root-readable directory dedicated to replication, and do not reuse an administrator’s key.
sudo install -d -m 0700 /etc/mysql-repl
sudo ssh-keygen -t ed25519 -f /etc/mysql-repl/repl_ed25519
sudo chmod 0600 /etc/mysql-repl/repl_ed25519Protect the directory and key with the operating system’s permissions or a secret-management system. If your organization supports hardware-backed keys, apply that control according to your SSH client and service-manager design.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Install and constrain the public key
Append the public key to the source account’s authorized_keys file. Add options that disable features the tunnel does not need and limit the destination of forwarded connections:
restrict,permitopen="127.0.0.1:3306" ssh-ed25519 AAAA... repl-tunnel-from-replicarestrict disables PTY allocation, agent forwarding, X11 forwarding, and other session features on OpenSSH versions that support it. On older versions, use the individual options no-pty,no-agent-forwarding,no-X11-forwarding and add permitopen="127.0.0.1:3306". The abbreviated key material above is only a line-format example; install the complete public key generated on the replica.
In sshd_config, permit local forwarding for this account but do not enable unrelated forwarding features. A matching Match User repl-tunnel block can set AllowTcpForwarding local, X11Forwarding no, and PermitTTY no. Reload the SSH daemon after validating its configuration with the distribution’s syntax-check command.
Verify the host key before starting replication
From the replica, connect once interactively as an administrator, inspect the fingerprint through an independent channel, and save the verified key in the service account’s known-hosts file. Do not use StrictHostKeyChecking=no; disabling checking permits a man-in-the-middle attacker to impersonate the source VPS.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minutesudo -u root ssh-keyscan -H 198.51.100.10 | sudo tee -a /etc/mysql-repl/known_hosts
sudo ssh -i /etc/mysql-repl/repl_ed25519 -o UserKnownHostsFile=/etc/mysql-repl/known_hosts repl-tunnel@198.51.100.10 trueOnly accept the key after comparing its fingerprint with a trusted console, provisioning record, or other independent source. The final test may return no shell output because the account is intentionally non-interactive.
Step 2: Start and supervise the local SSH forward
Test the tunnel manually
Run this on the replica:
sudo ssh -i /etc/mysql-repl/repl_ed25519
-o UserKnownHostsFile=/etc/mysql-repl/known_hosts
-o ExitOnForwardFailure=yes
-o ServerAliveInterval=30
-o ServerAliveCountMax=3
-N -L 127.0.0.1:13306:127.0.0.1:3306
repl-tunnel@198.51.100.10-N requests forwarding without a shell. ExitOnForwardFailure=yes makes a failed bind or rejected forward visible to the supervisor instead of leaving a misleading process running. The keepalive options detect a dead network path; they are not a substitute for a service manager.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
While this process runs, test a MySQL login from the replica against 127.0.0.1 and port 13306. Confirm that the returned server identity, version, and expected schemas belong to the source VPS. Stop the foreground process after the test and install it under supervision.
Use systemd (or the platform’s equivalent)
Create a root-owned unit on the replica such as:
[Unit]
Description=SSH tunnel for MySQL replication
After=network-online.target
Wants=network-online.target
[Service]
Type=simple
ExecStart=/usr/bin/ssh -i /etc/mysql-repl/repl_ed25519 -o UserKnownHostsFile=/etc/mysql-repl/known_hosts -o ExitOnForwardFailure=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=3 -N -L 127.0.0.1:13306:127.0.0.1:3306 repl-tunnel@198.51.100.10
Restart=always
RestartSec=5
[Install]
WantedBy=multi-user.targetSave it as /etc/systemd/system/mysql-repl-tunnel.service, set ownership and mode so ordinary users cannot alter it or the key, then run:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sudo systemctl daemon-reload
sudo systemctl enable --now mysql-repl-tunnel.service
sudo systemctl status mysql-repl-tunnel.serviceUse the equivalent service supervisor on non-systemd systems. Alert on repeated restarts, a failed unit, or loss of the local listening socket. A tunnel that dies silently stops replication even though both MySQL processes may still appear healthy.
Step 3: Configure MySQL and the replication account
Keep the source listener private
Configure the source MySQL server to bind to loopback or to a private interface reachable only from the tunnel host. The SSH destination above is 127.0.0.1:3306, so the source must accept that local connection. Do not bind MySQL to the public interface merely because the VPS has one, and do not add a public firewall exception for port 3306.
Protect binary logs on the source and relay logs on the replica with restrictive filesystem ownership and permissions. Include their directories in your disk-protection, backup, and retention policy; replication logs can contain row changes and credentials or other sensitive values.
Create a least-privilege replication user
Create the account on the source using the privilege set documented for your MySQL release. Grant only the privileges needed to read the source’s replication stream and perform the configured replication function; do not grant administrative, file, grant-option, or wildcard privileges.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
With local forwarding, the source normally sees the MySQL TCP connection as coming from its own loopback address, not from the replica’s VPS address. Therefore, a host restriction such as 'mysqlrepl'@'127.0.0.1' is often appropriate for this exact topology. Confirm the observed source address in your environment before choosing the account host value; a different forwarding design or proxy can change it.
Use a long, unique password generated for this account and store it in a protected secret store or root-readable configuration mechanism. Never put it directly in a shell command that will remain in history, a broadly readable unit file, or an application log. Rotate it with a planned replication pause and verify the channel afterward.
Apply replication settings on the replica
After the tunnel is running and the account exists, configure the replica to use the local endpoint. On MySQL 8.0.23 and later, the command shape is:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteCHANGE REPLICATION SOURCE TO
SOURCE_HOST='127.0.0.1',
SOURCE_PORT=13306,
SOURCE_USER='mysqlrepl',
SOURCE_PASSWORD='use-the-protected-secret',
SOURCE_AUTO_POSITION=1;The exact options depend on whether you use GTID auto-positioning, file-and-position coordinates, SSL/TLS settings, and named channels. Treat the password shown as a description, not a value to copy; supply it through your approved secret-handling process. On older MySQL releases, use the corresponding CHANGE MASTER TO syntax and the options supported by that version.
Start the channel with the command appropriate to your release, then inspect its status. Current releases commonly use START REPLICA and SHOW REPLICA STATUSG; older releases may use START SLAVE and SHOW SLAVE STATUSG. Confirm both I/O and SQL execution threads are running, authentication errors are absent, and the source identity matches the intended VPS.
Step 4: Lock down both VPS firewalls
| Traffic | Allow from | Destination | Reason |
|---|---|---|---|
| SSH tunnel (TCP 22, or your chosen SSH port) | Replica VPS fixed address only | Source VPS | Carries the encrypted forward |
| MySQL TCP 3306 | Source loopback, or the source private interface as required | Source MySQL | Never expose the database listener publicly |
| Replica local port 13306 | Replica loopback only | Replica | Accepts connections only from replica mysqld |
| Administrative SSH | Your management network | Each VPS | Separate from the tunnel account and rule |
Implement equivalent rules in the VPS provider’s security group and the operating-system firewall. Remove broad temporary rules after setup. Test from an unrelated external network that the source’s public address does not accept TCP 3306, and review both ingress and egress rules for accidental exposure. A private network reduces exposure but does not replace host-level firewalling.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
How to verify the deployment
- Verify SSH identity: confirm the saved host key fingerprint and ensure the service log shows no host-key change or authentication warning.
- Verify the forward: check that the replica has a listener on
127.0.0.1:13306, then connect through that port and confirm the expected MySQL server identity and version. - Verify replication state: inspect the channel status and confirm the I/O and SQL threads are running without access-denied, connection, or relay-log errors.
- Verify data movement: observe the source and replica positions during normal writes and confirm that lag remains within your operational objective.
- Verify restart behavior: reboot or restart the tunnel service during a maintenance window, ensure it reconnects, and confirm replication resumes without manual intervention.
- Verify exposure: inspect provider rules, host firewall configuration, listening sockets, and an external scan to ensure public port 3306 is closed.
- Verify logs and secrets: check that SSH, MySQL, binary, and relay logs have appropriate permissions and that passwords are absent from command history and service logs.
Alert on a stopped tunnel, repeated SSH reconnects, replication authentication or I/O errors, a stopped SQL thread, and sustained lag growth. A single successful connection test does not prove that the tunnel will survive a network interruption or VPS restart.
SSH versus native MySQL TLS
| Requirement | SSH tunnel | Native MySQL TLS |
|---|---|---|
| Encrypts replication traffic | Yes, through the SSH session | Yes, within the MySQL protocol |
| Authenticates the transport endpoint | SSH host-key verification | X.509 certificate validation, with client certificates when configured |
| Controls protocol versions | Through SSH implementation and policy | Explicit MySQL TLS protocol and cipher configuration |
| Requires a tunnel service | Yes; a failed tunnel interrupts replication | No separate SSH forward is required |
| Useful when | Both VPSs already have tightly managed SSH access and a simple private topology | Certificate identity, mutual authentication, or centrally enforced TLS policy is required |
| Main operational cost | Key distribution, host-key rotation, service supervision, and firewall coordination | Certificate issuance, renewal, trust-store management, and MySQL TLS configuration |
SSH is a valid encrypted TCP transport, but it does not by itself prove the database server’s identity with MySQL certificate semantics. Native TLS addresses that requirement and can be required for selected users or server connections. Running TLS inside an SSH tunnel provides defense in depth, although it adds another set of certificates, policies, and failure states to operate.
Failure modes and precise fixes
The tunnel process is running but replication cannot connect
Check that the local port is bound to 127.0.0.1, that ExitOnForwardFailure=yes did not report a rejected forward, and that the source MySQL listener accepts loopback connections. Verify the account host restriction against the source-observed address and confirm that the source firewall is not blocking its own private or loopback path.
SSH authentication or host-key errors appear after a rebuild
A rebuilt VPS may legitimately have a new host key, but an unexpected change can indicate interception. Stop the tunnel, verify the new fingerprint through an independent administrative channel, then replace the saved key deliberately. Do not solve the error by disabling strict host-key checking.
Replication stops whenever the network flaps
Read the tunnel unit’s journal, check keepalive and restart settings, and verify that only one supervisor instance owns the local port. After reconnection, inspect replication status for authentication, I/O, or relay-log errors and confirm that lag decreases instead of continuing to grow.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Port 3306 is visible from the internet
Remove public security-group and host-firewall rules, correct the MySQL bind address, and retest from outside both VPS networks. The SSH tunnel does not make a public MySQL listener safe; it only provides a protected path to a listener that should already be private.
The replication account has excessive privileges
Review its grants, revoke administrative or wildcard permissions, and recreate the account with only the release-specific replication privileges. Test the channel after the change and document the reason for every remaining grant. Apply MySQL’s replication applier privilege checks where supported by your release.
Replication works, but compliance requires certificate identity
Configure native MySQL TLS with a trusted certificate chain, validate the negotiated protocol and certificate rather than checking only whether a connection succeeds, and enforce TLS for the replication account or connection as required. You may retain SSH for network isolation if the additional operational complexity is acceptable.
Quick Recap
Operational hardening checklist
- Use a unique Ed25519 key for the tunnel and rotate it under a documented procedure.
- Keep the tunnel account non-interactive, outside administrative groups, and limited with
authorized_keysforwarding options. - Pin and monitor the source SSH host key; never use
StrictHostKeyChecking=no. - Bind the local forward to loopback and restrict the SSH destination with
permitopen. - Allow SSH only from the replica’s fixed address and keep source MySQL off the public interface.
- Use a dedicated MySQL replication account with the minimum privileges and a secret stored outside shell history.
- Protect binary and relay logs at rest with strict ownership, permissions, retention, and backup controls.
- Supervise the tunnel, alert on downtime and repeated restarts, and test recovery after reboot.
- Monitor replication threads, authentication errors, I/O errors, and sustained lag.
- Choose native MySQL TLS when certificate identity or independent protocol policy is a requirement.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
