In the example of the author creating a reverse tunnel for mysql, I can't decide if I love or hate these types of tunnels. On the one hand it's nice to allow SS

In the example of the author creating a reverse tunnel for mysql, I can't decide if I love or hate these types of tunnels. On the one hand it's nice to allow SSH to do all of the encryption heavy lifting, and to punch a single hole through the firewall. It's also nice that somebody sniffing around from the outside doesn't really have any idea what services are running on the box. On the other handle it comes off as much too hacky for something I'd trust my production services with. It also involves two levels of authentication (PKI + whatever is built-in to the system).