Skip to main content
In this configuration, Omni establishes an encrypted connection to an SSH server on your network, and then uses SSH’s Local Forwarding feature to route traffic through the SSH connection to the database in your network.
Modifying a connection with an established SSH tunnel may result in disruptions if you don’t contact Omni support beforehand.Changes include modifying the connection’s host or port as well as rebuilding the SSH server and thus changing the SSH host keys. Refer to Maintaining host keys for how to avoid this.

​
Setup

1

Set up the SSH server in your network

Omni recommends using OpenSSH server to complete this step, as it’s guaranteed to be compatible with the OpenSSH client Omni uses to establish a connection. Most Linux distributions come with OpenSSH installed or easily installable through a package manager.Your SSH server must:
  • Be in a network that accepts traffic on the SSH port from Omni’s outbound IP addresses
  • Be able to route traffic to the network that the database resides in
  • Be configured so that the database’s firewall accepts traffic from the SSH server
2

Contact Omni support

After you set up the SSH server, contact Omni support with the following information:
  • For the SSH server - The host, port, and user needed to connect
  • For the database you want to connect to Omni - The type of database, along with its host and port. The host should be a private IP address or a DNS entry that resolves to a private IP.
3

Authorize the public key

After Omni support receives the required information, we will generate an authentication keypair and send you the public key to authorize on your SSH server.
4

Confirm the connection

Once this is complete, Omni support will confirm the SSH connection can be established and add the new database connection to your Omni instance. The connection can then be used like any other database connection.

​
Maintaining host keys

Omni verifies your SSH server’s host key on every connection. If that key changes, connections will fail until you contact Omni support to update the key we have on file. If your patching process replaces SSH servers instead of upgrading them in place, Omni highly recommends maintaining constant host keys across replacements. Otherwise, every patch cycle generates a new host key and breaks the tunnel. The typical approach is to generate the host keys once, store them in a secrets manager - such as AWS Secrets Manager, Google Secret Manager, or HashiCorp Vault - and write them to /etc/ssh/ while provisioning the new server, before sshd starts. On cloud images, cloud-init’s SSH module supports this directly through the ssh_keys config key, which installs the host keys you provide instead of generating new ones on first boot.
If you use a load balancer or autoscaling group in front of multiple SSH servers, all servers behind it must present the same host key.