How to access phpMyAdmin from laptop via SSH tunnel through AWS bastion/jump server to EC2 instance using .ssh/config

Question

Need to reach phpMyAdmin on an EC2 instance behind a bastion/jumpserver from local laptop.

Looking to reduce these steps into using .shh/config. The question seeks to solve the right configurations.

When connecting to EC2 without public bastion server to jump through, this is the normal way documented which does not work in my case because our deployment uses a public facing bastion:

https://docs.bitnami.com/aws/faq/get-started/access-phpmyadmin/

When you need to jump through a public facing bastion e.g.:

Local/Laptop ------> bastion/jumpserver -----> ec2

This above reference link does not follow the same workflow and documentation is sparse. Setting up inbound/outbound rules for this capability is also sparse.

The preference is to use .ssh/config which is setup like this:

Host bastionHostTunnel
Hostname <publicBastionIp>
User <bastionusername>
ForwardAgent yes
IdentityFile <local path to .pem file>

Host ec2Host
Hostname <privateEC2IP>
User <ec2 username>
ForwardAgent yes
IdentityFile <local path to .pem file>
# -A Enable forwarding of the Authentication agent connection
# -W used on older machines instead of -J to bounce through
# %h the remote hostname
# On Windows 10(only?) seems must call ssh.exe instead of only ssh 
ProxyCommand ssh.exe -A -W %h:22 bastionHostTunnel

I obviously left out vars in <> above - but I have them and have verified similar configuration is working for enabling SFTP as above with FileZilla.

Then in shell call this to bind port localhost:8888 (http://127.0.0.1:8888):

ssh ec2Host -D 8888

Then ought to be able to open browser and go to the following to access phpMyAdmin:

http://127.0.0.1:8888/phpmyadmin

Current issue is that this process is hanging and possibly refusing the connection. This points to either bad configuration above or incorrect inbound/outbound rules for either/both bastion and ec2 instance.

Has anyone here had similar issue and was able to solve and could share further, much appreciated. Plus any extra clues as far as debugging the overall process would help in the answer.

Isaac Bennetch Isaac Bennetch · Accepted Answer · 2020-04-12T02:35:27

I'm most curious if it works if you specific everything on the command line...once you determine that works, you can start refactoring to put some aspects in to .ssh/config. It's usually easier for me to find errors with my configuration if everything is on the command line, plus I don't know that I see the correct forwarding options all listed there.

Unless I'm very mistaken, you don't need any reference to the ec2 host in your SSH config file because you're using the jump machine to redirect localhost traffic there, you wouldn't directly be able to reach the ec2 host machine from your local machine using an SSH tunnel.

There are many ways to do a tunnel, but when I do this, I use a command like ssh -L 8080:destination:80 -i <keyfile> me@jumpbox . destination must be reachable from jumpbox, which I can verify by first using ssh -i <keyfile> jumpbox then, once on that machine, ssh destination. If there's a problem along the way, it's easier to debug these little steps (for instance, if I can't connect by manual ssh to jumpbox then I know the tunnel will never work).

How to access phpMyAdmin from laptop via SSH tunnel through AWS bastion/jump server to EC2 instance using .ssh/config

1 Answers