🔐 How to Securely Access MySQL on AlmaLinux Using Cloudflare Zero Trust (No Public Ports)

🚀 Architecture Overview

Developer (Mac / Linux / Windows)
   ↓
SSH (cloudflared ProxyCommand)
   ↓
Cloudflare Access (Zero Trust Authentication)
   ↓
Cloudflare Tunnel
   ↓
AlmaLinux Server (localhost)
   ↓
MySQL (127.0.0.1:3306)

👉 This setup ensures:

• No open ports on the server
• Identity-based access control
• Secure database connectivity

🖥️ Server Setup (AlmaLinux)

Install Cloudflare Tunnel

sudo dnf install -y cloudflared

Configure Tunnel

sudo nano /etc/cloudflared/config.yml

tunnel: <TUNNEL_ID>
credentials-file: /root/.cloudflared/<TUNNEL_ID>.json

ingress:
  - hostname: ssh.namasteydigitalindia.com
    service: ssh://localhost:22

  - service: http_status:404

Start Tunnel

sudo systemctl enable cloudflared
sudo systemctl restart cloudflared

Verify Services

sudo systemctl status sshd
sudo systemctl status mysqld

🌐 Cloudflare Zero Trust Setup

Create Access Application

Navigate to:

Zero Trust → Access → Applications

Create:

• Name: NDI SSH
• Domain: ssh.namasteydigitalindia.com
• Type: Self-hosted

Add Access Policy

• Allow specific emails
• OR use group (recommended: NDI-SSH)

Configure WAF Rule (Important)

(http.host eq "ssh.namasteydigitalindia.com")

Action: Skip (or Allow)

💻 Client Setup

🍏 macOS / 🐧 Linux

Install cloudflared

brew install cloudflared     # macOS
sudo apt install cloudflared # Linux

Generate SSH Key

ssh-keygen -t ed25519 -C "[email protected]"

Configure SSH

nano ~/.ssh/config

Host ssh.namasteydigitalindia.com
     ProxyCommand cloudflared access ssh --hostname %h
     IdentityFile ~/.ssh/id_ed25519
     User <username>

Host mysql-ndi
     HostName ssh.namasteydigitalindia.com
     User <username>
     IdentityFile ~/.ssh/id_ed25519
     ProxyCommand cloudflared access ssh --hostname %h
     LocalForward 13306 127.0.0.1:3306

Start MySQL Tunnel

ssh -f -N mysql-ndi

---

🪟 Windows Setup

Install cloudflared

winget install Cloudflare.cloudflared

Generate SSH Key

ssh-keygen -t ed25519 -C "[email protected]"

Configure SSH

notepad %USERPROFILE%\.ssh\config

Host ssh.namasteydigitalindia.com
     ProxyCommand cloudflared access ssh --hostname %h
     IdentityFile C:\Users\<username>\.ssh\id_ed25519
     User <username>

Host mysql-ndi
     HostName ssh.namasteydigitalindia.com
     User <username>
     IdentityFile C:\Users\<username>\.ssh\id_ed25519
     ProxyCommand cloudflared access ssh --hostname %h
     LocalForward 13306 127.0.0.1:3306

Start Tunnel

ssh -N mysql-ndi

Test Connection

Test-NetConnection 127.0.0.1 -Port 13306

Expected:

TcpTestSucceeded : True

🧪 Connect Using DBeaver

Main Configuration

Host: 127.0.0.1
Port: 13306
Database: <db_name>
Username: <db_user>
Password: <db_password>

👉 Disable SSH tab — tunnel is already active.

📋 SOP: Add New Team Member

Step 1: Grant Access in Cloudflare

Zero Trust → Access → Applications → NDI SSH → Policies

Step 2: Generate SSH Key

ssh-keygen -t ed25519 -C "[email protected]"

Step 3: Add Key to Server

sudo nano /home/<user>/.ssh/authorized_keys

Step 4: Create Linux User

sudo adduser <user>
sudo passwd -l <user>

Step 5: Create MySQL User

CREATE USER 'user1'@'localhost' IDENTIFIED BY 'StrongPassword';
GRANT SELECT, INSERT, UPDATE ON db_name.* TO 'user1'@'localhost';
FLUSH PRIVILEGES;

Step 6: Connect

ssh -f -N mysql-ndi

Then use DBeaver → 127.0.0.1:13306

🔐 Security Best Practices

Disable password-based SSH

sudo nano /etc/ssh/sshd_config

PasswordAuthentication no
PermitRootLogin no

sudo systemctl restart sshd

Restrict MySQL to localhost

bind-address = 127.0.0.1

Use least-privilege DB users

🎯 Final Outcome

• ✔ No public database exposure
• ✔ Identity-based access (Zero Trust)
• ✔ Secure SSH + MySQL connectivity
• ✔ Cross-platform developer support

💡 Final Thoughts

This architecture follows modern Zero Trust principles, similar to what large-scale companies use for internal infrastructure access.

If you’re building secure SaaS or enterprise systems, this pattern is highly recommended.

👉 If you want help implementing this setup or scaling it for your team, visit namasteydigitalindia.com.