MariaDB via SSH tunnel fails with: unexpected end of stream, read 0 bytes from 4 (socket was closed by server)

[masgo]

Description

I have a turnkey wordpress test-system which is nearly unchanged from the default settings. Connecting to the MariaDB database does work without SSH tunnel but not via SSH tunnel.

For testing, I have set bind-address = * in the mariadb config and created a user which is allowed to connect from % (so from everywhere). These are obvious security problems, which is why I want to use an SSH tunnel.

If i set up a connection without SSH tunneling, everything works (all settings which are not shown, are default values from DBeaver)

If I go ahead and add an SSH tunnel, the tunnel seems to work fine.

But the DB connection does not work

I also tried 127.0.0.1 instead of localhost, but it gives me the same error.

I have connections to other MariaDB servers via SSH tunnels which work fine. As well as to other DBs via SSH tunnel.

DBeaver Version

Community Edition 25.2.1.202509211659

Operating System

Windows 10

Database and driver

1. Database Name: MariaDB 10.11.11
2. Driver Name: MariaDB Driver 3.5.2

Steps to reproduce

1. try to connect to DB via SSH tunnel fails with error: Could not connect to 127.0.0.1:38940 : unexpected end of stream, read 0 bytes from 4 (socket was closed by server)

Additional context

No response

Seems to have happened bevore:
#21812 - Seems very similar. Problem there was either localhost vs 127.0.0.1 or is unsolved.
And again here: #19388 But here they discuss the validationQuery. Which is obviously fine, since the change which causes the error for me is the added tunnel.
#22592 seems similar, but no further details there.

[labanovichttps]

@masgo Thank you for your report. Unfortunately, I cannot reproduce this issue; my SSH connection works fine. Could you please check your credentials, and if you have server logs or other log files that could help us to find out the reason, you could send us [email protected]

[optyler]

Hi, got the same issue right now.

But I use SSH + Jump Server... maybe it's a mis configuration, however, The "test tunnel" button works fine.

I tried, localhost, 127.0.0.1, srv-xxxxxxx-01, ... but always the same error

[nreynis]

I also have the exact same problem. Connecting with the mysql driver works, but not with mariaDB.

I have tested on the latest version on Windows and also on MacOS. I have tested both SSH implementations (SSHJ and JSch) as well

Testing the connection works, but the real connection gives me unexpected end of stream

[masgo]

which logfiles would be helpfull? The server logs are rather empty, i probably need to set the log level higher.

[Matyro]

I had the issue today but could resolve it by activating AllowTCPForward in ssh config, which was turned off after an update.
I had exactly the same issue as documented above.

Maybe the TestTunnel function could test the tunnel and not only the ssh connection?

[masgo]

@Matyro thank you. This is the solution!

To summarize for others: by default sshd has AllowTCPForward yes set.

AllowTcpForwarding
Specifies whether TCP forwarding is permitted. The default is ''yes''. Note that disabling TCP forwarding does not improve security unless users are also denied shell access, as they can always install their own forwarders.

Source: https://linux.die.net/man/5/sshd_config

Turns out that TurnkeyLinux adds it's own sshd config /etc/ssh/sshd_config.d/turnkey.conf where it sets AllowTCPForward no

# SSH hardening recommended by lynis
X11Forwarding no
AllowTcpForwarding yes
ClientAliveCountMax 2
MaxAuthTries 3
MaxSessions 2

Source: /etc/ssh/sshd_config.d/turnkey.conf from my wordpress turnkey linux

Obviously ssh tunneling can not work without TCP forwarding.

Further reading: CISOfy/lynis#220

[nreynis]

This does not work for me. @masgo can you reopen the issue?
That option was not overridden, I explicitly set it to true anyway.

Here is the tcp config if my ssh daemon

> sudo sshd -T | grep tcp
tcpkeepalive yes
allowtcpforwarding yes

And here is my full configuration

> sudo sshd -T
port 22
addressfamily any
listenaddress 0.0.0.0:22
usepam yes
logingracetime 120
x11displayoffset 10
maxauthtries 6
maxsessions 100
clientaliveinterval 60
clientalivecountmax 240
streamlocalbindmask 0177
permitrootlogin no
ignorerhosts yes
ignoreuserknownhosts no
hostbasedauthentication no
hostbasedusesnamefrompacketonly no
pubkeyauthentication yes
kerberosauthentication no
kerberosorlocalpasswd yes
kerberosticketcleanup yes
gssapiauthentication no
gssapicleanupcredentials yes
gssapikeyexchange no
gssapistrictacceptorcheck yes
gssapistorecredentialsonrekey no
gssapikexalgorithms gss-group14-sha256-,gss-group16-sha512-,gss-nistp256-sha256-,gss-curve25519-sha256-,gss-group14-sha1-,gss-gex-sha1-
passwordauthentication no
kbdinteractiveauthentication no
challengeresponseauthentication no
printmotd no
printlastlog yes
x11forwarding yes
x11uselocalhost no
permittty yes
permituserrc yes
strictmodes yes
tcpkeepalive yes
permitemptypasswords no
compression yes
gatewayports no
usedns no
allowtcpforwarding yes
allowagentforwarding yes
disableforwarding no
allowstreamlocalforwarding yes
streamlocalbindunlink no
fingerprinthash SHA256
exposeauthinfo no
pidfile /run/sshd.pid
xauthlocation /usr/bin/xauth
ciphers [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
macs [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
banner none
forcecommand none
chrootdirectory none
trustedusercakeys none
revokedkeys none
securitykeyprovider internal
authorizedprincipalsfile none
versionaddendum none
authorizedkeyscommand none
authorizedkeyscommanduser none
authorizedprincipalscommand none
authorizedprincipalscommanduser none
hostkeyagent none
kexalgorithms curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
casignaturealgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],ssh-ed25519,[email protected],rsa-sha2-512,rsa-sha2-256
hostbasedacceptedkeytypes [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],ssh-ed25519,[email protected],rsa-sha2-512,rsa-sha2-256,ssh-rsa
hostkeyalgorithms [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],ssh-ed25519,[email protected],rsa-sha2-512,rsa-sha2-256,ssh-rsa
pubkeyacceptedkeytypes [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],ssh-ed25519,[email protected],rsa-sha2-512,rsa-sha2-256,ssh-rsa
loglevel INFO
syslogfacility AUTH
authorizedkeysfile .ssh/authorized_keys .ssh/authorized_keys2
hostkey /etc/ssh/ssh_host_rsa_key
hostkey /etc/ssh/ssh_host_ecdsa_key
hostkey /etc/ssh/ssh_host_ed25519_key
acceptenv LANG
acceptenv LC_*
authenticationmethods any
subsystem sftp /usr/lib/openssh/sftp-server
maxstartups 50:30:100
permittunnel no
ipqos lowdelay throughput
rekeylimit 0 0
permitopen any
permitlisten any
permituserenvironment yes
pubkeyauthoptions none

[optyler]

Same for me, I checked my two servers and the AllowTCPForward seems to be good.

## first bounce
root@prototype ~ # sshd -T | grep tcp
tcpkeepalive yes
allowtcpforwarding yes

## final destination server
root@srv-xyz:~# sshd -T | grep tcp
tcpkeepalive yes
allowtcpforwarding yes

[masgo]

It was definetley the AllowTCPForward setting for me. The end of stream error usually points to a firewall blocking the connection. Can you exclude the firewall? Maybe try port-forwarding with putty and see if that works?

[nreynis]

This must be something specific to the MariaDB connector implementation. The exact same database works with the MySQL connector (minus MariaDB exclusive features).

Also as I said I reproduce on both MacOS and Windows. My database is on a locally run VM.

[SolovevAnton]

Thank you for your report. I have reproduced it.

[SolovevAnton]

I have studied the problem further. It appears that after all this error is specific to the SSH layer or server-side configuration, rather than a DBeaver or MariaDB driver bug.

If anyone encounters similar issues, it would be helpful if you could share any specific SSH or database settings you are using — for example:

• Your SSH tunnel configuration or any non-default options
• Any special MariaDB/MySQL server settings
• Any DBeaver connection options you changed

This information may help us identify patterns or reproduce the issue in environments where the error only seems to appear with incorrect SSH configuration.

[optyler]

In addition to my previous posts :

• MariaDB via SSH tunnel fails with: unexpected end of stream, read 0 bytes from 4 (socket was closed by server) #39301 (comment)
• MariaDB via SSH tunnel fails with: unexpected end of stream, read 0 bytes from 4 (socket was closed by server) #39301 (comment)

No special config on mariadb that I know.

Here is a light version of my SSH config in ~/.ssh/config :

Host *
 AddKeysToAgent yes
 ServerAliveInterval 300
 ServerAliveCountMax 2

Host * !*baz
 User       foo

Host srv-*
    ProxyJump jumpServer

Host jumpServer
    HostName  11.11.11.11

Host srv-xyz-1
    HostName  22.22.22.22

Host srv-xyz-2
    HostName  33.33.33.33

[Destrolaric]

Thanks for the discussion and for the provided answers. I am going to convert this issue to a discussion and mark the answer about TCP forwarding as an answer.