Configuring available SSH tunnels for a workspace

The SSH tunneling option is currently in private preview. To request access, contact Tonic.ai.

For PostgreSQL, Amazon Redshift, and Snowflake, you can configure server connections to connect through an SSH bastion tunnel.

On the workspace settings page, the Network tunnels section contains the list of available tunnels.

Required sshd_config settings

Fabricate's SSH network tunneling uses the direct-tcpip SSH channel to open connections inside your private network.

To support this, your /etc/ssh/sshd_config must include the following options:

• AllowTcpForwarding local
• PermitOpen <host>:<port>, where:

  • <host> is the hostname for the database.
  • <port> is the port for the database.

Here is an example configuration:

Match User fabricate-tunnel-user
    # Required for tunneling
    AllowTcpForwarding local
    PermitOpen <host>:<port>

    # Not required for tunneling. For additional security,
    # you can explicitly disable these options.
    AllowStreamLocalForwarding no
    AllowAgentForwarding no
    X11Forwarding no
    PermitTunnel no
    GatewayPorts no
    PermitTTY no
    PermitUserRC no
    ForceCommand /sbin/nologin

    # Other configuration. Set these based on your network.
    PasswordAuthentication no
    AuthenticationMethods publickey

Information in the tunnels list

For each tunnel, the list includes:

• The name of the tunnel.
• The type of tunnel. Fabricate currently only supports SSH bastion tunnels.
• The SSH bastion host address.
• The user to use for the connection.
• When the tunnel was most recently modified.

Adding a tunnel

To add a tunnel, click Add Network Tunnel.

Add Network Tunnel panel to add a network tunnel to the workspace

Setting the tunnel name and type

On the Add Network Tunnel panel:

1. In the Name field, provide a name for the tunnel. After you save the tunnel, you cannot change the tunnel name.
2. From the Type dropdown list, select the tunnel type. Fabricate currently only supports SSH bastion tunnels.

Setting the bastion host and port

For an SSH bastion tunnel:

1. In the Bastion host field, provide the host to use for the tunnel connection.
2. In the Port field, provide the port to use for the tunnel connection.

Configuring the authentication

From the Authentication dropdown list, select the type of authentication to use. The options are:

• Private key
• Password

Providing the private key and key passphrase

For private key authentication:

Fields to configure a private key for network tunnel authentication

1. In the Private key field, paste the content of an OpenSSH private key.
2. Optionally, in the Key passphrase field, provide the required passphrase to use with the key.

Providing the password

For password authentication, in the Password field, provide the password.

Fields to configure a password for network tunnel authentication

Requiring a pinned identity for the bastion host

To require the bastion host to verify its identity:

1. Check the Require pinned identity checkbox.
2. In the Host key fingerprints text area, provide one or more SHA256 encrypted keys or a public key lines. Put each item on a separate line.

Providing host key fingerprints to verify the bastion identity

Providing notes about the tunnel

In the Notes field, provide any additional notes about the tunnel and how to use it.

Testing and saving the tunnel

1. To test the configuration, click Test tunnel.
2. To save the tunnel, click Save.

Editing a tunnel configuration

To edit the configuration of an existing tunnel:

1. In the Network tunnels list, click the edit icon for the tunnel.
2. On the tunnel details, edit the configuration. You cannot change the tunnel name.
3. To test the updated configuration, click Test tunnel.
4. To save the configuration changes, click Save.

The configuration changes do not apply to requests that are currently using the tunnel. Future requests use the new configuration.

Deleting a tunnel

You cannot delete a tunnel that is used in a server connection.

To delete a tunnel:

1. In the Network tunnels list, click the delete icon for the tunnel.
2. On the confirmation panel, click Delete.