Reverse SSH

Perform the following steps to set up the reverse SSH tunnel on Linux:

Create an SSH user and generate key pair

Log in to your SSH tunnel host and run the following commands:

1. Create group fivetran:

   sudo groupadd fivetran
   

2. Create user fivetran:

   sudo useradd -m -g fivetran fivetran
   

3. Switch to the fivetran user:

   sudo su - fivetran
   

4. Create the .ssh directory:

   mkdir ~/.ssh
   

5. Set permissions:

   chmod 700 ~/.ssh
   

6. Generate an SSH key pair. Make a note of the key path - you will need it to complete your setup.

   ssh-keygen
   

   Do not enter a password for the key file. When prompted to provide a password, hit Enter instead.

7. View the contents of the public key.

   cat ~/.ssh/id_rsa.pub
   

8. Send the public key along with the SSH server's IP address and SSH username (fivetran) to Fivetran Support.

Once we create the Reverse SSH host and complete the setup on our side, we will provide you with the Reverse SSH host IP address and username. Then, proceed to the next step to initiate the SSH connection between your SSH server and Fivetran's Reverse SSH host.

Initiate SSH connection

To set up a secure tunnel between your local database and Fivetran's server, run the autossh command on your SSH server.

autossh -M 0 -f -N -R <SSH_HIGH_PORT>:<LOCAL_DB_MACHINE_NAME_OR_IP>:<LOCAL_DB_MACHINE_PORT> <FIVETRAN_SSH_USERNAME>@<FIVETRAN_SUPPLIED_IP> -g -i <PATH_TO_PRIVATE_KEY> -o ServerAliveInterval=10 -o ServerAliveCountMax=1 -o ExitOnForwardFailure=yes

Replace the placeholder variables with the actual values:

• SSH_HIGH_PORT: It should be unique for each connection and should not be a reserved port number (for instance, port 22 is reserved for SSH connections and port 443 is reserved for HTTPS).

  For the SSH high port number, we recommend adding a single digit - usually 1 - as a prefix to the source database port. For example, if you connect SQL Server, your database's default port is 1433. Therefore, we recommend using port 11433 as the SSH high port for your first SQL Server connection, port 11434 for your second connection, and so on.

• LOCAL_DB_MACHINE_NAME_OR_IP: Internal IP address or name of the local database host machine

• LOCAL_DB_MACHINE_PORT: Internal port for communication with the database host. For High-Volume Agent connectors, this is the Agent Listener Port (for example, 4343).

• FIVETRAN_SSH_USERNAME: SSH username for Fivetran's Reverse SSH host - fivetran

• FIVETRAN_SUPPLIED_IP: Reverse SSH host IP address provided by Fivetran (contact Fivetran Support or your Fivetran Technical Team to get this)

• PATH_TO_PRIVATE_KEY: File path to the private key on the SSH host machine (this is normally id_rsa.pem or simply id_rsa)

Enter values into connection setup form

Once the reverse SSH tunnel is successfully established, enter the following values in Fivetran's connection setup form:

All fields in { brackets } must be replaced with your actual values.

To set up a reverse SSH tunnel on Windows, you need to install PuTTY (an SSH and Telnet client) and PuTTYgen (a key generation tool) on your Windows machine. You can download the standalone binaries (EXE) or the installer package (MSI) for these tools from the official PuTTY download page.

Perform the following steps to set up a reverse SSH tunnel on Windows:

Generate key pair

1. Launch PuTTYgen.

2. Under Parameters, in the Type of key to generate field, select RSA.

3. In the Number of bits in a generated key field, enter 2048.

4. Under Actions, click Generate to create a public/private key pair.

5. Click Save public key to save the public key file to your local computer.

6. Click Save private key to save the private key file (.ppk) to your local computer.

   Do not save the key with a passphrase.

7. Send the public key, along with the SSH server's (Windows machine) IP address and SSH username (local Windows user running PuTTY) to Fivetran Support.

Once we create the Reverse SSH host and complete the setup on our side, we will provide you with the Reverse SSH host IP address and user name. Then proceed to the next step to configure and initiate the SSH connection between your SSH server and Fivetran's Reverse SSH Host.

Configure and initiate SSH connection

1. Launch PuTTY.

2. In the Session category, configure your session:

   • In the Host Name field, enter the user name and IP address of the Reverse SSH Host provided by the Fivetran team in the format {ssh_user}@{ssh_host_ip} (e.g., fivetran@35.230.100.17).
   • In the Port field, enter 22.
   • Under Connection type, select the SSH option.

3. In the Connection category, set the Seconds between keepalives to 5.

4. In the Connection > SSH category, select the Don’t start a shell or command at all checkbox.

5. In the Connection > SSH > Auth > Credentials category, go to the Private key file for authentication field. Click Browse and select the private key file (.ppk) you created in the previous step (Generate key pair).

6. In the Connection > SSH > TTY category, select the Don’t allocate a pseudo-terminal checkbox.

7. In the Connection > SSH > Tunnels category, configure port forwarding:

   • Select the Local ports accept connections from other hosts checkbox.
   • Select the Remote ports do the same checkbox.
   • Under Add new forwarded port:
     • In the Source port field, enter a high port number (e.g., 55432). The high port can be any non-reserved and unused port.
     • In the Destination field, enter your destination IP address and the database's port (e.g., localhost:5432 for a server hosted on the same computer).
     • Select the Remote option.
     • Select the Auto option.
     • Click Add to add this entry to the list of Forwarded ports.

8. In the Session category, save the configuration and initiate the SSH session:

   • In the Saved Sessions field, enter a name for this configuration (e.g., fivetran-outbound).
   • Click Save to save your configuration.
   • In the saved sessions list, select the newly saved session (e.g., fivetran-outbound).
   • Click Open to start the SSH session. This will open a terminal window and establish the SSH connection based on your configuration.

(Optional) Run PuTTY as a Service

When using a reverse SSH tunnel, it is important for the SSH session to automatically reconnect after a reboot or login to ensure uninterrupted remote access. Running PuTTY as a service through the Windows Task Scheduler ensures that your saved PuTTY session starts automatically, maintaining the reverse SSH tunnel without manual intervention.

Perform the following steps to run PuTTY as a service:

Save PuTTY session

1. Navigate to the PuTTY installation directory (for example, C:\puTTY\).
2. Open putty.exe and configure your reverse SSH tunnel.
3. Save the session with a descriptive name (for example, 'ReverseSSHExample').
4. (Optional) Create a shortcut for quick access:
   • Right-click and drag putty.exe into the same directory.
   • Select Create shortcut here.
   • Right-click the shortcut and go to Properties.
   • In the Target field, append: -load 'ReverseSSHExample'.

Configure Task Scheduler

1. Press Windows + S, type 'task scheduler', and then press Enter.
2. Open the Task Scheduler desktop application.
3. In the Task Scheduler window, select Action > Create Task.
4. In the General tab:
   • Enter the task name (for example, Launch PuTTY with Config).
   • Select the Run only when user is logged on checkbox.
   • Select the Run with highest privileges checkbox.
5. Go to the Triggers tab and click New.
6. In the Begin the task drop-down menu, select At log on.
7. Click OK.
8. Go to the Actions tab and click New.
9. In the New Action window, click Browse and select putty.exe.
10. In the Add arguments (optional) field, type: -load 'ReverseSSHExample'.
11. Click OK to save.
12. Go to the Conditions tab.
13. Clear the Start the task only if the computer is on AC power checkbox.
14. Click OK.
15. Go to the Settings tab.
16. Ensure that only the Allow task to be run on demand checkbox is selected.
17. Clear all other checkboxes.
18. Click OK.

Test and Verify

1. In Task Scheduler, right-click your created task and select Run.
2. If prompted with a PuTTY Security Alert (first connection), click Accept to cache the host key.
3. Once the session starts, confirm you have a successful connection.
4. (Optional validation) Restart your Windows system to confirm PuTTY auto-starts with the saved session.