SSH Tunnel Server — User Guide

What is the SSH Tunnel Server?

The SSH Tunnel Server (ts-sap-hana-s4-ssh-tunnel) is a lightweight Debian Linux VM hosted on Google Cloud Platform that serves as a secure jump host (bastion host) for accessing the SAP landscape from external networks.

The SAP servers (S/4HANA, ECC Oracle, SQL Server, HVR Hub) reside on internal GCP networks without external IP addresses. This tunnel server has both an internal IP (for reaching SAP systems) and an external IP (for accepting connections from the internet), bridging the two.

Server Details

Network Topology

Service Details

Configuration

Start / Stop / Restart

The cockpit provides Start, Stop, and Restart buttons for the SSH service.

• Start — starts the SSH daemon; no password required
• Stop — stops the SSH daemon; requires master password. All active SSH sessions will be terminated.
• Restart — restarts the SSH daemon; requires master password. Active sessions will be briefly interrupted.

Command line (from sapidesecc8):

# Check status
ssh root@sapidesecc8 "ssh root@10.142.0.37 'systemctl status ssh'"

# Start SSH service
ssh root@sapidesecc8 "ssh root@10.142.0.37 'systemctl start ssh'"

# Stop SSH service (WARNING: all sessions will be terminated)
ssh root@sapidesecc8 "ssh root@10.142.0.37 'systemctl stop ssh'"

# Restart SSH service
ssh root@sapidesecc8 "ssh root@10.142.0.37 'systemctl restart ssh'"

# Enable SSH on boot
ssh root@sapidesecc8 "ssh root@10.142.0.37 'systemctl enable ssh'"

If already logged in on the tunnel server:

sudo systemctl status ssh
sudo systemctl start ssh
sudo systemctl stop ssh
sudo systemctl restart ssh

User Accounts

Credentials

Connection Methods

From your Mac (key-based, no password):

ssh fivetran@35.229.110.30

Via GCP Identity-Aware Proxy (IAP):

gcloud compute ssh ts-sap-hana-s4-ssh-tunnel --zone=us-east1-b --project=internal-sales

From sapidesecc8 (key-based, no password):

ssh root@10.142.0.37      # as root
ssh fivetran@10.142.0.37  # as fivetran

SSH Jump Host

Use the -J flag to jump through the tunnel server to reach internal SAP hosts:

# Jump to S/4HANA server via tunnel
ssh -J fivetran@35.229.110.30 root@sapidess4

# Jump to ECC Oracle server
ssh -J fivetran@35.229.110.30 root@sapidesecc8

Port Forwarding

Forward local ports to internal SAP services through the tunnel:

Multiple tunnels in one command:

ssh -L 3200:sapidess4:3200 \
    -L 3201:sapidesecc8:3200 \
    -L 30015:sapidess4:30015 \
    fivetran@35.229.110.30

Adding SSH Keys

The cockpit provides an Add SSH Public Key form that appends a public key to /home/fivetran/.ssh/authorized_keys on the tunnel server.

• Paste any standard SSH public key (ssh-rsa, ssh-ed25519, or ecdsa)
• The key is checked for duplicates — if the key body already exists, it won’t be added again
• An added-by-claude comment is appended to keys added through the portal
• Keys are added to the fivetran user only (not root)

Authorized Keys Files

Firewall

Security Considerations

• Root access: SSH key only (prohibit-password) — password login as root is impossible
• OS updates: Debian 12 (bookworm) is current stable (upgraded 2026-04-14 from Debian 11 bullseye)
• Unattended upgrades: The unattended-upgrades service is running for automatic security patches
• ClientAliveInterval: Set to 120 seconds — idle sessions are kept alive to prevent disconnection
• Monitoring: The web server (sapidesecc8) checks tunnel server reachability via the Management Cockpit

Common Issues

Diagnostic Commands

# Check SSH service status
ssh root@sapidesecc8 "ssh root@10.142.0.37 'systemctl status ssh'"

# Check active sessions
ssh root@sapidesecc8 "ssh root@10.142.0.37 'who'"

# Check sshd config syntax
ssh root@sapidesecc8 "ssh root@10.142.0.37 'sshd -t && echo OK || echo FAILED'"

# Check auth log
ssh root@sapidesecc8 "ssh root@10.142.0.37 'tail -20 /var/log/auth.log'"

# Check disk space
ssh root@sapidesecc8 "ssh root@10.142.0.37 'df -h /'"

# Restart SSH after config change
ssh root@sapidesecc8 "ssh root@10.142.0.37 'systemctl restart ssh'"

SMTP Configuration

This server is configured to send email via smtp2go relay using Exim4.

Send a test email:

echo "Test" | mail -s "Test from sshtunnel" -a "From: sshtunnel@fivetran-internal-sales.com" recipient@email.com

Cockpit API Endpoints

How It Works

All cockpit operations are executed remotely from sapidesecc8. The web server (sapidesecc8) SSHs to the tunnel server (root@10.142.0.37) using key-based authentication and runs commands. The results are returned as JSON to the browser.