Cannot access AWS RDS MySQL DB from CLI MySQL Linux client; works great from Navicat -

ok, set mysql rds db in aws. not publicly accessible. if putty ec2 box on same subnet can access db via tunnelling when fire navicat.

switch linux redhat box (running percona 5.5.44). want connect tunnel rds db , have available locally on port 3308 (port 3306 has local mysql db already, 3307 [backup]).

telnet localhost 3308 

returns

trying 127.0.0.1... telnet: connect address 127.0.0.1: connection refused 

so, nothing there, expect.

run ssh:

ssh -l 3308:blahblah.us-east-1.rds.amazonaws.com:3306 -i key.ssh user@aws_ec2box.com -f -n 

where blahblah rds server , aws_ec2 ec2 server on same subnet.

try telnet again:

trying 127.0.0.1... connected localhost. escape character '^]'. n 5.6.23-logv[>e`3|9▒7{(sl_zgu7rumysql_native_password 

i know db want runnning mysql 5.6.23, db seeking.

now try:

mysql -p 3308 -u testuser -p enter password: error 1045 (28000): access denied user 'testuser'@'localhost' (using password: yes) 

no matter user try, password, without, setting plugin mysql_old_password , using old_password, anything- fails.

but can set putty , navicat windows pc, , in every time- same users, same passwords. putty tunnels using same ec2 box, , goes same rds box. i've torn down , re-done connections multiple times on both sides. no joy. doing wrong?

the 'testuser'@'localhost' in error message giveaway you're doing here not same thing intended do.

rds never identify coming localhost.

the issue here invocation of mysql command line client -p (--port) option, without corresponding -h (--host) argument. without --host, --port ignored (this appears undocumented, makes sense if think -- ip port without associated ip host doesn't have well-defined meaning).

you connecting local machine on unix socket. (set global log_warnings = 2; on local mysql instance , you'll see these failed logins in local mysql error log.)

$ mysql -h 127.0.0.1 -p 3308 -u testuser -p 

...is combination of options you're looking for.