Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Quick question - I run two linux boxes, one my own desktop and the other my VPS. For security reasons on the VPS end I opted for socket connections to MySQL (/var/run/mysqld/mysql.sock). I know I can tunnel like this: ssh -L 3307: if I set up the remote sql server to listen on some port, but what I want to know is can I do something like: ssh -L /path/to/myremotesqlserver.sock:/var/run/mysqld/mysql.sock thereby tunnelling two sockets, as opposed to two ports?

A perfectly acceptable solution would also be to forward a local port to the remote socket file, but where possible I'm trying not to have tcp servers running on the remote box.

(and yes, I know tcp would be easier).

share|improve this question
If the reason you don't want to use TCP on the mySQL box is because of security concerns (i.e. remote attacks, etc) you can ofcourse either firewall it, and if that is not good enough, make mySQL only listen to for its TCP connections, then you can tunnel through SSH easily. If not, I support the socat solution below. – Mattias Ahnberg Feb 22 '12 at 23:30 OpenSSH 6.7 will bring socket forwarding – Hubbitus Feb 25 '15 at 9:01

Forward a local socket on demand

  • Setup SSH public key authentication
  • Install socat at both ends
  • create a directory locally for your sockets, inaccessible to other users.
export SOCKET_DIR=~/.remote-sockets
socat "UNIX-LISTEN:$SOCKET_DIR/mysqld.sock,reuseaddr,fork" \
EXEC:'ssh user@server socat STDIO UNIX-CONNECT\:/var/run/mysqld/mysqld.sock'


mysql -S $SOCKET_DIR/mysqld.sock -u mysqluser -p

stolen from forwarding unix domain sockets with ssh and socat

share|improve this answer
This is awesome and should be the accepted answer. – John Smith Optional Dec 10 '15 at 21:58

i haven't done this, but i would try with socat. maybe something like:

ssh xxx@yyy.zzz -L 9999:localhost:9999 "socat TCP-LISTEN:localhost:9999 UNIX-CONNECT:/var/run/mysqld/mysql.sock"
socat UNIX-LISTEN:/path/to/local/socket TCP:localhost:9999

again, i have never done anything like this.

share|improve this answer
I'll give it a go and let you know how it goes. I've been using the tcp-based implementation. – user32616 Mar 30 '10 at 20:18
I can't get it to work at the moment but +1 anyway for the idea, I like it. I'll let you know if I fix it. – user32616 Mar 30 '10 at 20:32
+1 looks like a useful utility. – Warner Mar 30 '10 at 20:43

Yes, you can using socat.

First do the TCP tunnel with SSH. Then use socat like this:

socat unix-listen:/var/run/mysqld/mysqld.sock,fork,unlink-early tcp:

Then give permissions to new created socket (chmod 777 may be)

share|improve this answer
This is possible since OpenSSH 6.6. – ysdx Jan 9 '15 at 18:07
chmod 777: nonononono! Never ever run chmod 777. It is practically never required! Not even for "testing purposes". If the file is readable, then it's readable. If it's writable by the user or group that need to write to it, then it's writable. There is absolutely zero need to give everyone write permissions, and forgetting to chmod it back to something sane is exactly how multinationals get hacked. Just don't do it. Ever. I wrote an introduction of Unix permissions. Please read it! – Carpetsmoker Mar 13 at 6:00

Elaborating on Javier's answer, this works for me:

ssh -f xxx@yyy.zzz -L 9999:localhost:9999 "socat TCP-LISTEN:9999,fork,bind=localhost UNIX-CONNECT:/var/run/mysqld/mysql.sock"

You need fork in order to be able to connect multiple times without socat dying once you close the first connection. Also, the way socat lets you specify an address to bind to is through the bind option, not as an address before the port.

After this, just connect to localhost:9999 normally as you would. Then to teardown the tunnel:

ssh -f xxx@yyy.zzz "killall socat"

(or something similar, you can do more elaborate things that involve keeping socat's PID)

share|improve this answer

Altough in the time, when the question was asked, it was really impossible, but it is possible nowadays.

You can to both: UNIX=>TCP and UNIX=>UNIX forwarding.

For example:

ssh \
  -R/var/run/mysql.sock:/var/run/mysql.sock \
  -R127.0.0.1:3306:/var/run/mysql.sock \

It is possible since OpenSSH 6.7.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.