Make MySQL Use the Forwarded TCP Port

The SSH forward listens on local port 13306, but mysql still connects to the local database—or reports that its local socket is missing. On Unix, a MySQL client given localhost can select a Unix socket rather than TCP. Supplying a port does not necessarily change that choice.

For an existing approved TCP forward, make the protocol explicit:

mysql --protocol=TCP --host=127.0.0.1 --port=13306 \
  --user=dbuser --password

The username is illustrative; the password option requests an interactive prompt. The command connects to the local TCP listener instead of a Unix socket.

Keep the two logins separate

A fixed SSH route can have this shape:

ssh -N -L 127.0.0.1:13306:db.internal:3306 [email protected]

The gateway's SSH server reaches db.internal:3306. MySQL then authenticates the database account through that byte stream. An accepted SSH key does not grant a database login, and database source restrictions see the connection arriving from that side of the route.

This is a fixed TCP adapter, not a SOCKS setting consumed by mysql. The application needs no SOCKS negotiation because the forwarding endpoint has one predefined target.

Retain the intended database TLS identity and certificate policy where used. Connecting the socket to loopback does not make a database certificate valid for a different service name. A successful local TCP connection settles the transport choice, not the later database authentication or TLS checks.