SaaS Redash traffic always arrives from our public IP address:
52.71.84.157. We recommend directly whitelisting this address through
your firewall. Alternatively, you can set up an SSH tunnel using the API
described below.
Two sets of details are needed to connect Redash with your database over SSH: database access details and SSH access details.
Database access details are always entered into Redash directly,
regardless whether an SSH tunnel is required. Any member of the admin
group can do this from the Settings.Data Sources tab. For
tunneled connections, the host for your data source will be the
private hostname within your VPC/intranet. Attempts to connect with
this data source will fail unless your firewall allows traffic from our
IP or you configure an SSH tunnel.
SSH access details are supplied using Redash's REST API because this feature has not yet been added to our front-end user interface. The tunnel API uses public key authentication to connect with a bastion server in your network. Once connected to the bastion via SSH, Redash sends the database access details to your database.
For this to work, your bastion host must be exposed over the internet.
And you should add our public
key to
.ssh/allowed_keys within the home folder of the system user that
Redash will use to authenticate. We recommend creating a dedicated user
for this purpose.
Note: SSH Connections are ad-hoc. A new connection is tried on each query execution.
You will need:
(a.) The address, port, and system user that Redash will use to connect with your bastion (b.) The URL for the data source to be tunneled (c.) The organization slug for your hosted account (d.) The API key of an admin user within your organization (available from the Profile screen)
Copy your organization slug and the numerical data source ID and make an
API call to the /api/data_sources endpoint.
https://app.redash.io/<slug>/api/data_sources/<data source id>
This request must include an Authorization header with a value of
Key <admin api key>.
The JSON response includes all the details for the specified data
source. Copy the name, type, and options objects and proceed to
the next step.
Make a POST api call to the same endpoint as step 1 adding an
ssh_tunnel object with three key-value-pairs: ssh_host, ssh_port,
and ssh_username. Using the values from (a) above. For example:
{
"name": "My Sample Database",
"type": "pg",
"options": {
"host": "private.address.in.my.domain.xyz",
"port": 5432,
"database": "sampledb",
"user": "redash-db-user",
"password": "-------------------",
"ssh_tunnel": {
"ssh_username": "redash-tunnel",
"ssh_port": 22,
"ssh_host": "bastion.my.domain.xyz"
}
}
}
If you receive an HTTP response with code 200 then your SSH access
details were saved.
You can either visit the data source within Redash and click Test
Connection or make a POST api call to
https://app.redash.io/<slug>/api/data_sources/<data source id>/test.
The JSON response will indicate whether Redash successfully reached your database through the tunnel.