SupportConsole
llms.txtSign in

Remote access, phpMyAdmin and SSH tunnels

llms.txt

By default a database that SrvYard installs listens on the server's loopback address only. Nothing on the internet can reach it, which is exactly what you want. But sooner or later you need to look inside: to run a query, import a dump or hand a colleague read access.

This article shows the three ways to do that, from safest to most exposed: an SSH tunnel from your computer, phpMyAdmin on the server itself, and a remote user for another server on your private network. It finishes with the firewall page, because every route to a database goes through it.

Before you begin

  • A database on a Ready server. See Create a database and a user.
  • Your own SSH access to the server. The tunnel uses your server login, not a SrvYard password. Add your public key on the server's SSH keys tab first.
  • A database client, for example the mysql command line, TablePlus, DBeaver or Sequel Ace. Almost all of them can also open the tunnel for you in an SSH tab.
Important

Do not open port 3306 (MySQL, MariaDB) or 5432 (PostgreSQL) to the whole internet. Bots scan for these ports around the clock. Prefer a tunnel; if you must allow a remote address, limit the rule to that address.

1. Use an SSH tunnel from your computer

Open the server's Databases tab and scroll to the card at the bottom.

The Connect from your computer card
The card at the bottom of the Databases tab: open a tunnel, then connect to 127.0.0.1.
  1. Open the tunnel. Press Copy and paste the command into a terminal on your own computer, replacing YOUR_USER with your server login. It looks like ssh -N -L 3306:127.0.0.1:3306 [email protected]. The window stays open and silent: that is the tunnel working. Press Ctrl+C to close it. If the server's SSH port is not 22, the command already contains -p with the right port.
  2. Connect to the tunnel. In your client, use host 127.0.0.1, the port shown (3306, or 5432 for PostgreSQL), the database name, and the database user and password. The card gives you the shape of the connection string, mysql://USER:[email protected]:3306/DATABASE.

Because the traffic travels inside SSH, it is encrypted, the database port stays closed to the world, and the database user can stay a plain local user with no remote access at all. If another program on your computer already uses port 3306, change the first number of the tunnel, for example -L 3307:127.0.0.1:3306, and use 3307 in the client.

Tip

Create a separate Read only user for tunnelled work such as reporting. A forgotten tunnel then cannot change data.

2. Install phpMyAdmin

phpMyAdmin is a web page for browsing and editing a MySQL or MariaDB database. SrvYard installs it as a normal site, with its own Linux user, PHP-FPM pool and Nginx configuration. It uses the pinned release 5.2.3.

Open Sites > New site and choose phpMyAdmin.

The Install phpMyAdmin form
Protect with a password puts a second login in front of phpMyAdmin itself.
  1. Server. Choose the server that runs the database. The server needs MySQL or MariaDB: if it has none, the form says so and links you to the Services tab. PostgreSQL is not supported by this site type.
  2. Protect with a password. On by default, and worth keeping on. It puts HTTP Basic authentication in front of phpMyAdmin, so only people who know this login even see the database login screen. Set a Username, and either type a Password or press Generate password. Store it in your password manager.

Choose a domain below (a free srvy.sh name or your own), then press Create site. When the site is ready, open the address, pass the Basic login and sign in with a database user. phpMyAdmin uses cookie authentication against the server's own database engine at 127.0.0.1, and it refuses logins with an empty password.

Warning

A public phpMyAdmin is a favourite target. Always protect it with a password, get a Let's Encrypt certificate for it straight away, and delete the site when you no longer need it. You can create it again in a minute.

3. Allow a remote user

Sometimes software on another server has to talk to the database directly. Do not use the internet for that: put both servers in the same provider and region and use the private network.

The New user panel with Allow remote access on
Allow remote access adds a field for the one address, or address range, that may connect.
  1. Allow remote access. Switch it on for the user. Without it the user can only log in from the server itself.
  2. Allowed host or IP. One address such as 10.0.1.11, or a pattern such as 10.0.0.%. A single % means any host and defeats the purpose.

The panel adds a reminder that matters: the engine must also listen on that address and the firewall must allow the port. SrvYard never opens the port for you. Both are steps you take on purpose:

  • The listening address. SrvYard installs MySQL and MariaDB with bind-address = 127.0.0.1 in /etc/mysql/mysql.conf.d/zz-srvyard.cnf. Because that file is read after mysqld.cnf, changing bind-address in the Edit configuration editor of the Services tab does not override it by itself. Plan the change over SSH, with a database administrator, and restart the engine afterwards.
  • The firewall. See the next step.

4. Open the port for one address only

Open the server's Firewall tab.

The Firewall tab
The Firewall tab: SSH, web traffic and a MySQL rule that is limited to the private network.
  1. Add rule opens the form.
  2. The existing rules show the pattern to copy. MySQL from the private network allows port 3306 over TCP, but only from 10.0.0.0/16. SSH, HTTP and HTTPS are open to anywhere. Incoming traffic is denied unless a rule allows it.
The Add firewall rule panel
Allow a port for one address only: leave the source empty and the port is open to the whole internet.
  1. Name. Anything that tells you why the rule exists, for example MySQL from web-02.
  2. Action. Allow or Deny. Deny rules are applied first.
  3. Protocol. TCP for databases.
  4. Port. 3306, 5432, or a range such as 8000:8100.
  5. Source. One or more addresses or CIDR ranges, separated by commas, such as 10.0.1.11. Leave it empty and the rule means anywhere, so always fill it in for database ports.

SrvYard rebuilds the whole firewall on the server when you save. Port 22 for SSH is always kept open, so a mistake here cannot lock SrvYard out of your server.

For several servers that should reach each other, Settings > Server network on the server grants other servers of the same provider and region access and creates the matching firewall rule for you.

Troubleshooting

  • "bind: Address already in use" when opening the tunnel. Something on your computer already listens on that port, perhaps a local database. Use another local port, for example -L 3307:127.0.0.1:3306.
  • The tunnel asks for a password or says "Permission denied". Your key is not on the server. Add it on the SSH keys tab, then try again.
  • "Access denied" through the tunnel. The database user may not exist for localhost, or the password is wrong. Check the Users tab and reset the password if needed.
  • A remote client times out. The firewall rule is missing, the source does not match the client's address, or the engine still listens on loopback only.
  • "Install MySQL or MariaDB first" on the phpMyAdmin form. The chosen server has no MySQL-family engine. Install one from its Services tab.
  • I forgot the phpMyAdmin password. SrvYard does not show it again. Delete the site and create it again with a new password; your other databases are not affected.
Last updated 2026-10-247 min readNeed help? Contact support
PreviousConnect a site to its databaseNextImport and export a database