SSH Tunneling

When sshEnabled is on, verify these fields before testing:

• sshHost, sshPort
• sshUser
• one auth path (sshPassword or sshKeyFile)

Use read-only DB credentials while validating tunnel behavior.

QuraMate SSH flow verifies host keys and checks known hosts entries. If host key is untrusted or changed, treat it as a security checkpoint, not a retry loop.

Expected trust flow:

1. fetch host key info (host, port, key type, fingerprint)
2. compare against expected/pinned fingerprint
3. trust only after explicit operator decision

If key mismatch appears, stop and verify rotation reason before continuing.

Use dedicated SSH credentials per environment. Avoid sharing a single jump-host user across unrelated teams or risk levels.

After a successful tunnel test, move to Connections and then Session Recovery to verify restart behavior.