How do you connect your company database securely?

#No new database port to open

In a meeting to review an AI rollout, the IT team gets a request: "Open the database port so the AI server can connect." That database sits deep inside the internal network, behind the firewall, and the only way in from outside is the SSH bastion (the gateway server into the internal network) that the operations staff use. A security lead has little appetite for opening a new port, or for handing a bastion account to an AI. And once a path is open, there is the question of whether data travels over it in plain text.

You don't need to open a new database port. OwlAI reaches the database through an SSH tunnel over the bastion you already have. It does not take a password or private key for any bastion account; you add a single line for OwlAI to the bastion. Data to and from the database is encrypted with TLS, and OwlAI checks the database server's certificate on every connection.

#The bastion gets one line

OwlAI creates and keeps its own SSH key for each organization, and the connection screen shows one line to add to the bastion account's authorized_keys. A login with that line has no shell and cannot run commands; the only path it opens is to the database addresses written in the line. OwlAI has no way to get onto the bastion and look around at other servers. “The bastion gets one key line that only forwards to the database, not an account” covers what the line contains and how to set up the bastion side.

There is also a check on the bastion itself. At first registration, the administrator compares the bastion's host key fingerprint (an identifier unique to each bastion) shown on screen with the value the bastion's administrator provided. From then on, OwlAI connects only when the fingerprint matches exactly, so if someone hijacks the bastion address and redirects it to another server, OwlAI will not connect to that server. If the bastion is reinstalled and its fingerprint changes, OwlAI does not connect until an administrator confirms it again.

The tunnel opens when a query runs and closes when the query finishes. No standing connection between OwlAI and the bastion is left open.

#With SaaS, the addresses to allow are fixed

On-premises, OwlAI is installed inside your network, so the bastion's SSH port only needs to allow the OwlAI server's address. With SaaS, OwlAI connects from outside your network. That is why a database at a private address cannot be registered directly; you connect it through a bastion with a public address. The addresses OwlAI uses when it connects out to your side are fixed, and the connection screen lists them under Addresses to allow. Allow only those addresses on the bastion's firewall. There is no need to open SSH to the whole internet.

#Encrypted to the database, with the certificate checked

The SSH tunnel encrypts the leg from OwlAI to the bastion. To encrypt the internal leg from the bastion to the database as well, use TLS alongside it. TLS runs through the tunnel all the way to the database, and it starts turned on when you add a connection.

With TLS on, OwlAI always checks the database server's certificate and name. If the certificate comes from an authority it cannot trust, or carries a different name, OwlAI does not connect. Encryption without that check would happily hold an encrypted conversation with a server that has slipped into the middle. A database with a publicly trusted certificate needs nothing extra; if your internal certificate authority issued the certificate, paste that authority's certificate into the connection.

For a database that does not use TLS, you can turn it off. If that connection does not go through a tunnel either, the connection list marks it Unencrypted connection. Your security team can pick out connections where data may travel in plain text straight from the list.

#What to check before you connect

Before connecting an internal database to OwlAI, settle the following with your IT department and the bastion's administrator.

• Whether the bastion in front of the database runs OpenSSH 7.2 or later
• A dedicated bastion account for OwlAI with shell login disabled
• The bastion's host key fingerprint, obtained from its administrator
• The OwlAI address to allow on the bastion's SSH port (with SaaS, the Addresses to allow on the connection screen)
• Whether the database uses TLS, and if an internal certificate authority is involved, its certificate