diff --git a/superset-frontend/packages/superset-ui-core/src/utils/featureFlags.ts b/superset-frontend/packages/superset-ui-core/src/utils/featureFlags.ts
index 012bb4ebaf9ec..524d5a6d1c14f 100644
--- a/superset-frontend/packages/superset-ui-core/src/utils/featureFlags.ts
+++ b/superset-frontend/packages/superset-ui-core/src/utils/featureFlags.ts
@@ -63,6 +63,7 @@ export enum FeatureFlag {
   USE_ANALAGOUS_COLORS = 'USE_ANALAGOUS_COLORS',
   UX_BETA = 'UX_BETA',
   VERSIONED_EXPORT = 'VERSIONED_EXPORT',
+  SSH_TUNNELING = 'SSH_TUNNELING',
 }
 export type ScheduleQueriesProps = {
   JSONSCHEMA: {
diff --git a/superset-frontend/src/views/CRUD/data/database/DatabaseModal/DatabaseConnectionForm/index.tsx b/superset-frontend/src/views/CRUD/data/database/DatabaseModal/DatabaseConnectionForm/index.tsx
index af4923e7b9823..f6284ae67d9a7 100644
--- a/superset-frontend/src/views/CRUD/data/database/DatabaseModal/DatabaseConnectionForm/index.tsx
+++ b/superset-frontend/src/views/CRUD/data/database/DatabaseModal/DatabaseConnectionForm/index.tsx
@@ -73,6 +73,7 @@ export interface FieldPropTypes {
     onRemoveTableCatalog: (idx: number) => void;
   } & {
     onExtraInputChange: (value: any) => void;
+    onSSHTunnelParametersChange: (value: any) => string;
   };
   validationErrors: JsonObject | null;
   getValidation: () => void;
diff --git a/superset-frontend/src/views/CRUD/data/database/DatabaseModal/SSHTunnelForm.tsx b/superset-frontend/src/views/CRUD/data/database/DatabaseModal/SSHTunnelForm.tsx
new file mode 100644
index 0000000000000..d73c00265d0a4
--- /dev/null
+++ b/superset-frontend/src/views/CRUD/data/database/DatabaseModal/SSHTunnelForm.tsx
@@ -0,0 +1,265 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import React, { EventHandler, ChangeEvent, useState } from 'react';
+import { t, SupersetTheme, styled } from '@superset-ui/core';
+import { AntdForm, AntdSwitch, Col, Row } from 'src/components';
+import InfoTooltip from 'src/components/InfoTooltip';
+import { Form, FormLabel } from 'src/components/Form';
+import { Radio } from 'src/components/Radio';
+import { Input, TextArea } from 'src/components/Input';
+import { Input as AntdInput, Tooltip } from 'antd';
+import { EyeInvisibleOutlined, EyeOutlined } from '@ant-design/icons';
+import { isEmpty } from 'lodash';
+import { infoTooltip, toggleStyle } from './styles';
+
+import { DatabaseObject } from '../types';
+import { AuthType } from '.';
+
+const StyledDiv = styled.div`
+  padding-top: ${({ theme }) => theme.gridUnit * 2}px;
+  label {
+    color: ${({ theme }) => theme.colors.grayscale.base};
+    text-transform: uppercase;
+    margin-bottom: ${({ theme }) => theme.gridUnit * 2}px;
+  }
+`;
+
+const StyledRow = styled(Row)`
+  padding-bottom: ${({ theme }) => theme.gridUnit * 2}px;
+`;
+
+const StyledFormItem = styled(AntdForm.Item)`
+  margin-bottom: 0 !important;
+`;
+
+const StyledInputPassword = styled(AntdInput.Password)`
+  margin: ${({ theme }) => `${theme.gridUnit}px 0 ${theme.gridUnit * 2}px`};
+`;
+
+const SSHTunnelForm = ({
+  db,
+  dbFetched,
+  isEditMode,
+  sshTunneling,
+  onSSHTunnelParametersChange,
+  setSSHTunnelLoginMethod,
+  removeSSHTunnelConfig,
+}: {
+  db: DatabaseObject | null;
+  dbFetched: DatabaseObject | null;
+  isEditMode: boolean;
+  sshTunneling: boolean;
+  onSSHTunnelParametersChange: EventHandler<
+    ChangeEvent<HTMLInputElement | HTMLTextAreaElement>
+  >;
+  setSSHTunnelLoginMethod: (method: AuthType) => void;
+  removeSSHTunnelConfig: () => void;
+}) => {
+  const [useSSHTunneling, setUseSSHTunneling] = useState<boolean>(
+    !isEmpty(db?.ssh_tunnel),
+  );
+  const [usePassword, setUsePassword] = useState<AuthType>(AuthType.password);
+
+  return (
+    <Form>
+      <div css={(theme: SupersetTheme) => infoTooltip(theme)}>
+        <AntdSwitch
+          disabled={
+            !sshTunneling || (isEditMode && !isEmpty(dbFetched?.ssh_tunnel))
+          }
+          checked={useSSHTunneling}
+          onChange={changed => {
+            setUseSSHTunneling(changed);
+            if (!changed) removeSSHTunnelConfig();
+          }}
+          data-test="ssh-tunnel-switch"
+        />
+        <span css={toggleStyle}>SSH Tunnel</span>
+        <InfoTooltip
+          tooltip={t('SSH Tunnel configuration parameters')}
+          placement="right"
+          viewBox="0 -5 24 24"
+        />
+      </div>
+      {useSSHTunneling && (
+        <>
+          <StyledRow gutter={16}>
+            <Col xs={24} md={12}>
+              <StyledDiv>
+                <FormLabel htmlFor="server_address" required>
+                  {t('SSH Host')}
+                </FormLabel>
+                <Input
+                  name="server_address"
+                  type="text"
+                  placeholder={t('e.g. 127.0.0.1')}
+                  value={db?.ssh_tunnel?.server_address || ''}
+                  onChange={onSSHTunnelParametersChange}
+                  data-test="ssh-tunnel-server_address-input"
+                />
+              </StyledDiv>
+            </Col>
+            <Col xs={24} md={12}>
+              <StyledDiv>
+                <FormLabel htmlFor="server_port" required>
+                  {t('SSH Port')}
+                </FormLabel>
+                <Input
+                  name="server_port"
+                  type="text"
+                  placeholder={t('22')}
+                  value={db?.ssh_tunnel?.server_port || ''}
+                  onChange={onSSHTunnelParametersChange}
+                  data-test="ssh-tunnel-server_port-input"
+                />
+              </StyledDiv>
+            </Col>
+          </StyledRow>
+          <StyledRow gutter={16}>
+            <Col xs={24}>
+              <StyledDiv>
+                <FormLabel htmlFor="username" required>
+                  {t('Username')}
+                </FormLabel>
+                <Input
+                  name="username"
+                  type="text"
+                  placeholder={t('e.g. Analytics')}
+                  value={db?.ssh_tunnel?.username || ''}
+                  onChange={onSSHTunnelParametersChange}
+                  data-test="ssh-tunnel-username-input"
+                />
+              </StyledDiv>
+            </Col>
+          </StyledRow>
+          <StyledRow gutter={16}>
+            <Col xs={24}>
+              <StyledDiv>
+                <FormLabel htmlFor="use_password" required>
+                  {t('Login with')}
+                </FormLabel>
+                <StyledFormItem name="use_password" initialValue={usePassword}>
+                  <Radio.Group
+                    onChange={({ target: { value } }) => {
+                      setUsePassword(value);
+                      setSSHTunnelLoginMethod(value);
+                    }}
+                  >
+                    <Radio
+                      value={AuthType.password}
+                      data-test="ssh-tunnel-use_password-radio"
+                    >
+                      {t('Password')}
+                    </Radio>
+                    <Radio
+                      value={AuthType.privateKey}
+                      data-test="ssh-tunnel-use_private_key-radio"
+                    >
+                      {t('Private Key & Password')}
+                    </Radio>
+                  </Radio.Group>
+                </StyledFormItem>
+              </StyledDiv>
+            </Col>
+          </StyledRow>
+          {usePassword === AuthType.password && (
+            <StyledRow gutter={16}>
+              <Col xs={24}>
+                <StyledDiv>
+                  <FormLabel htmlFor="password" required>
+                    {t('SSH Password')}
+                  </FormLabel>
+                  <StyledInputPassword
+                    name="password"
+                    placeholder={t('e.g. ********')}
+                    value={db?.ssh_tunnel?.password || ''}
+                    onChange={onSSHTunnelParametersChange}
+                    data-test="ssh-tunnel-password-input"
+                    iconRender={visible =>
+                      visible ? (
+                        <Tooltip title="Hide password.">
+                          <EyeInvisibleOutlined />
+                        </Tooltip>
+                      ) : (
+                        <Tooltip title="Show password.">
+                          <EyeOutlined />
+                        </Tooltip>
+                      )
+                    }
+                    role="textbox"
+                  />
+                </StyledDiv>
+              </Col>
+            </StyledRow>
+          )}
+          {usePassword === AuthType.privateKey && (
+            <>
+              <StyledRow gutter={16}>
+                <Col xs={24}>
+                  <StyledDiv>
+                    <FormLabel htmlFor="private_key" required>
+                      {t('Private Key')}
+                    </FormLabel>
+                    <TextArea
+                      name="private_key"
+                      placeholder={t('Paste Private Key here')}
+                      value={db?.ssh_tunnel?.private_key || ''}
+                      onChange={onSSHTunnelParametersChange}
+                      data-test="ssh-tunnel-private_key-input"
+                      rows={4}
+                    />
+                  </StyledDiv>
+                </Col>
+              </StyledRow>
+              <StyledRow gutter={16}>
+                <Col xs={24}>
+                  <StyledDiv>
+                    <FormLabel htmlFor="private_key_password" required>
+                      {t('Private Key Password')}
+                    </FormLabel>
+                    <StyledInputPassword
+                      name="private_key_password"
+                      placeholder={t('e.g. ********')}
+                      value={db?.ssh_tunnel?.private_key_password || ''}
+                      onChange={onSSHTunnelParametersChange}
+                      data-test="ssh-tunnel-private_key_password-input"
+                      iconRender={visible =>
+                        visible ? (
+                          <Tooltip title="Hide password.">
+                            <EyeInvisibleOutlined />
+                          </Tooltip>
+                        ) : (
+                          <Tooltip title="Show password.">
+                            <EyeOutlined />
+                          </Tooltip>
+                        )
+                      }
+                      role="textbox"
+                    />
+                  </StyledDiv>
+                </Col>
+              </StyledRow>
+            </>
+          )}
+        </>
+      )}
+    </Form>
+  );
+};
+export default SSHTunnelForm;
diff --git a/superset-frontend/src/views/CRUD/data/database/DatabaseModal/SqlAlchemyForm.tsx b/superset-frontend/src/views/CRUD/data/database/DatabaseModal/SqlAlchemyForm.tsx
index 1fac50d343385..003a26c9a1715 100644
--- a/superset-frontend/src/views/CRUD/data/database/DatabaseModal/SqlAlchemyForm.tsx
+++ b/superset-frontend/src/views/CRUD/data/database/DatabaseModal/SqlAlchemyForm.tsx
@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import React, { EventHandler, ChangeEvent, MouseEvent } from 'react';
+import React, { EventHandler, ChangeEvent, MouseEvent, ReactNode } from 'react';
 import { t, SupersetTheme } from '@superset-ui/core';
 import SupersetText from 'src/utils/textUtils';
 import Button from 'src/components/Button';
@@ -30,12 +30,14 @@ const SqlAlchemyTab = ({
   testConnection,
   conf,
   testInProgress = false,
+  children,
 }: {
   db: DatabaseObject | null;
   onInputChange: EventHandler<ChangeEvent<HTMLInputElement>>;
   testConnection: EventHandler<MouseEvent<HTMLElement>>;
   conf: { SQLALCHEMY_DOCS_URL: string; SQLALCHEMY_DISPLAY_TEXT: string };
   testInProgress?: boolean;
+  children?: ReactNode;
 }) => {
   let fallbackDocsUrl;
   let fallbackDisplayText;
@@ -99,6 +101,7 @@ const SqlAlchemyTab = ({
           {t('for more information on how to structure your URI.')}
         </div>
       </StyledInputContainer>
+      {children}
       <Button
         onClick={testConnection}
         loading={testInProgress}
diff --git a/superset-frontend/src/views/CRUD/data/database/DatabaseModal/index.test.tsx b/superset-frontend/src/views/CRUD/data/database/DatabaseModal/index.test.tsx
index 79b0bd626921e..96bcace64761d 100644
--- a/superset-frontend/src/views/CRUD/data/database/DatabaseModal/index.test.tsx
+++ b/superset-frontend/src/views/CRUD/data/database/DatabaseModal/index.test.tsx
@@ -38,6 +38,11 @@ import DatabaseModal, {
   ActionType,
 } from './index';
 
+jest.mock('@superset-ui/core', () => ({
+  ...jest.requireActual('@superset-ui/core'),
+  isFeatureEnabled: () => true,
+}));
+
 const dbProps = {
   show: true,
   database_name: 'my database',
@@ -126,6 +131,7 @@ fetchMock.mock(AVAILABLE_DB_ENDPOINT, {
         'postgresql://user:password@host:port/dbname[?key=value&key=value...]',
       engine_information: {
         supports_file_upload: true,
+        allow_ssh_tunneling: true,
       },
     },
     {
@@ -135,6 +141,7 @@ fetchMock.mock(AVAILABLE_DB_ENDPOINT, {
       preferred: true,
       engine_information: {
         supports_file_upload: true,
+        allow_ssh_tunneling: false,
       },
     },
     {
@@ -187,6 +194,7 @@ fetchMock.mock(AVAILABLE_DB_ENDPOINT, {
         'mysql://user:password@host:port/dbname[?key=value&key=value...]',
       engine_information: {
         supports_file_upload: true,
+        allow_ssh_tunneling: false,
       },
     },
     {
@@ -196,6 +204,7 @@ fetchMock.mock(AVAILABLE_DB_ENDPOINT, {
       preferred: true,
       engine_information: {
         supports_file_upload: true,
+        allow_ssh_tunneling: true,
       },
     },
     {
@@ -205,6 +214,7 @@ fetchMock.mock(AVAILABLE_DB_ENDPOINT, {
       preferred: false,
       engine_information: {
         supports_file_upload: true,
+        allow_ssh_tunneling: false,
       },
     },
     {
@@ -229,6 +239,7 @@ fetchMock.mock(AVAILABLE_DB_ENDPOINT, {
       sqlalchemy_uri_placeholder: 'bigquery://{project_id}',
       engine_information: {
         supports_file_upload: true,
+        allow_ssh_tunneling: false,
       },
     },
     {
@@ -239,6 +250,7 @@ fetchMock.mock(AVAILABLE_DB_ENDPOINT, {
       preferred: false,
       engine_information: {
         supports_file_upload: false,
+        allow_ssh_tunneling: false,
       },
     },
     {
@@ -445,6 +457,21 @@ describe('DatabaseModal', () => {
       const SQLURIHelper = screen.getByText(
         /refer to the for more information on how to structure your uri\./i,
       );
+      // <SSHTunnelForm> - Basic tab's SSH Tunnel Form
+      const SSHTunnelingToggle = screen.getByTestId('ssh-tunnel-switch');
+      userEvent.click(SSHTunnelingToggle);
+      const SSHTunnelServerAddressInput = screen.getByTestId(
+        'ssh-tunnel-server_address-input',
+      );
+      const SSHTunnelServerPortInput = screen.getByTestId(
+        'ssh-tunnel-server_port-input',
+      );
+      const SSHTunnelUsernameInput = screen.getByTestId(
+        'ssh-tunnel-username-input',
+      );
+      const SSHTunnelPasswordInput = screen.getByTestId(
+        'ssh-tunnel-password-input',
+      );
       const testConnectionButton = screen.getByRole('button', {
         name: /test connection/i,
       });
@@ -479,6 +506,11 @@ describe('DatabaseModal', () => {
         SQLURILabel,
         SQLURIInput,
         SQLURIHelper,
+        SSHTunnelingToggle,
+        SSHTunnelServerAddressInput,
+        SSHTunnelServerPortInput,
+        SSHTunnelUsernameInput,
+        SSHTunnelPasswordInput,
         testConnectionButton,
         alertIcon,
         alertMessage,
@@ -1164,6 +1196,107 @@ describe('DatabaseModal', () => {
           expect.anything();
         });
       });
+
+      describe('SSH Tunnel Form interaction', () => {
+        test('properly interacts with SSH Tunnel form textboxes', async () => {
+          userEvent.click(
+            screen.getByRole('button', {
+              name: /sqlite/i,
+            }),
+          );
+
+          expect(await screen.findByText(/step 2 of 2/i)).toBeInTheDocument();
+          const SSHTunnelingToggle = screen.getByTestId('ssh-tunnel-switch');
+          userEvent.click(SSHTunnelingToggle);
+          const SSHTunnelServerAddressInput = screen.getByTestId(
+            'ssh-tunnel-server_address-input',
+          );
+          expect(SSHTunnelServerAddressInput).toHaveValue('');
+          userEvent.type(SSHTunnelServerAddressInput, 'localhost');
+          expect(SSHTunnelServerAddressInput).toHaveValue('localhost');
+          const SSHTunnelServerPortInput = screen.getByTestId(
+            'ssh-tunnel-server_port-input',
+          );
+          expect(SSHTunnelServerPortInput).toHaveValue('');
+          userEvent.type(SSHTunnelServerPortInput, '22');
+          expect(SSHTunnelServerPortInput).toHaveValue('22');
+          const SSHTunnelUsernameInput = screen.getByTestId(
+            'ssh-tunnel-username-input',
+          );
+          expect(SSHTunnelUsernameInput).toHaveValue('');
+          userEvent.type(SSHTunnelUsernameInput, 'test');
+          expect(SSHTunnelUsernameInput).toHaveValue('test');
+          const SSHTunnelPasswordInput = screen.getByTestId(
+            'ssh-tunnel-password-input',
+          );
+          expect(SSHTunnelPasswordInput).toHaveValue('');
+          userEvent.type(SSHTunnelPasswordInput, 'pass');
+          expect(SSHTunnelPasswordInput).toHaveValue('pass');
+        });
+
+        test('if the SSH Tunneling toggle is not true, no inputs are displayed', async () => {
+          userEvent.click(
+            screen.getByRole('button', {
+              name: /sqlite/i,
+            }),
+          );
+
+          expect(await screen.findByText(/step 2 of 2/i)).toBeInTheDocument();
+          const SSHTunnelingToggle = screen.getByTestId('ssh-tunnel-switch');
+          expect(SSHTunnelingToggle).toBeVisible();
+          const SSHTunnelServerAddressInput = screen.queryByTestId(
+            'ssh-tunnel-server_address-input',
+          );
+          expect(SSHTunnelServerAddressInput).not.toBeInTheDocument();
+          const SSHTunnelServerPortInput = screen.queryByTestId(
+            'ssh-tunnel-server_port-input',
+          );
+          expect(SSHTunnelServerPortInput).not.toBeInTheDocument();
+          const SSHTunnelUsernameInput = screen.queryByTestId(
+            'ssh-tunnel-username-input',
+          );
+          expect(SSHTunnelUsernameInput).not.toBeInTheDocument();
+          const SSHTunnelPasswordInput = screen.queryByTestId(
+            'ssh-tunnel-password-input',
+          );
+          expect(SSHTunnelPasswordInput).not.toBeInTheDocument();
+        });
+
+        test('If user changes the login method, the inputs change', async () => {
+          userEvent.click(
+            screen.getByRole('button', {
+              name: /sqlite/i,
+            }),
+          );
+
+          expect(await screen.findByText(/step 2 of 2/i)).toBeInTheDocument();
+          const SSHTunnelingToggle = screen.getByTestId('ssh-tunnel-switch');
+          userEvent.click(SSHTunnelingToggle);
+          const SSHTunnelUsePasswordInput = screen.getByTestId(
+            'ssh-tunnel-use_password-radio',
+          );
+          expect(SSHTunnelUsePasswordInput).toBeVisible();
+          const SSHTunnelUsePrivateKeyInput = screen.getByTestId(
+            'ssh-tunnel-use_private_key-radio',
+          );
+          expect(SSHTunnelUsePrivateKeyInput).toBeVisible();
+          const SSHTunnelPasswordInput = screen.getByTestId(
+            'ssh-tunnel-password-input',
+          );
+          // By default, we use Password as login method
+          expect(SSHTunnelPasswordInput).toBeVisible();
+          // Change the login method to use private key
+          userEvent.click(SSHTunnelUsePrivateKeyInput);
+          const SSHTunnelPrivateKeyInput = screen.getByTestId(
+            'ssh-tunnel-private_key-input',
+          );
+          expect(SSHTunnelPrivateKeyInput).toBeVisible();
+          const SSHTunnelPrivateKeyPasswordInput = screen.getByTestId(
+            'ssh-tunnel-private_key_password-input',
+          );
+          expect(SSHTunnelPrivateKeyPasswordInput).toBeVisible();
+        });
+      });
     });
 
     describe('Dynamic form flow', () => {
@@ -1784,6 +1917,7 @@ describe('dbReducer', () => {
       payload: {
         engine_information: {
           supports_file_upload: true,
+          allow_ssh_tunneling: true,
         },
         ...db,
         driver: db.driver,
@@ -1798,6 +1932,7 @@ describe('dbReducer', () => {
       configuration_method: db.configuration_method,
       engine_information: {
         supports_file_upload: true,
+        allow_ssh_tunneling: true,
       },
       driver: db.driver,
       expose_in_sqllab: true,
@@ -1806,4 +1941,77 @@ describe('dbReducer', () => {
       name: 'PostgresDB',
     });
   });
+
+  test('it will add a SSH Tunnel config parameter', () => {
+    const action: DBReducerActionType = {
+      type: ActionType.parametersSSHTunnelChange,
+      payload: { name: 'server_address', value: '127.0.0.1' },
+    };
+    const currentState = dbReducer(databaseFixture, action);
+
+    expect(currentState).toEqual({
+      ...databaseFixture,
+      ssh_tunnel: {
+        server_address: '127.0.0.1',
+      },
+    });
+  });
+
+  test('it will add a SSH Tunnel config parameter with existing configs', () => {
+    const action: DBReducerActionType = {
+      type: ActionType.parametersSSHTunnelChange,
+      payload: { name: 'server_port', value: '22' },
+    };
+    const currentState = dbReducer(
+      {
+        ...databaseFixture,
+        ssh_tunnel: {
+          server_address: '127.0.0.1',
+        },
+      },
+      action,
+    );
+
+    expect(currentState).toEqual({
+      ...databaseFixture,
+      ssh_tunnel: {
+        server_address: '127.0.0.1',
+        server_port: '22',
+      },
+    });
+  });
+
+  test('it will change a SSH Tunnel config parameter with existing configs', () => {
+    const action: DBReducerActionType = {
+      type: ActionType.parametersSSHTunnelChange,
+      payload: { name: 'server_address', value: 'localhost' },
+    };
+    const currentState = dbReducer(
+      {
+        ...databaseFixture,
+        ssh_tunnel: {
+          server_address: '127.0.0.1',
+        },
+      },
+      action,
+    );
+
+    expect(currentState).toEqual({
+      ...databaseFixture,
+      ssh_tunnel: {
+        server_address: 'localhost',
+      },
+    });
+  });
+
+  test('it will remove the SSH Tunnel config parameters', () => {
+    const action: DBReducerActionType = {
+      type: ActionType.removeSSHTunnelConfig,
+    };
+    const currentState = dbReducer(databaseFixture, action);
+    expect(currentState).toEqual({
+      ...databaseFixture,
+      ssh_tunnel: undefined,
+    });
+  });
 });
diff --git a/superset-frontend/src/views/CRUD/data/database/DatabaseModal/index.tsx b/superset-frontend/src/views/CRUD/data/database/DatabaseModal/index.tsx
index 095e4f0225db5..fae25219cf87c 100644
--- a/superset-frontend/src/views/CRUD/data/database/DatabaseModal/index.tsx
+++ b/superset-frontend/src/views/CRUD/data/database/DatabaseModal/index.tsx
@@ -88,6 +88,7 @@ import {
   StyledUploadWrapper,
 } from './styles';
 import ModalHeader, { DOCUMENTATION_LINK } from './ModalHeader';
+import SSHTunnelForm from './SSHTunnelForm';
 
 const DEFAULT_EXTRA = JSON.stringify({ allows_virtual_table_explore: true });
 
@@ -145,6 +146,14 @@ export enum ActionType {
   removeTableCatalogSheet,
   reset,
   textChange,
+  parametersSSHTunnelChange,
+  setSSHTunnelLoginMethod,
+  removeSSHTunnelConfig,
+}
+
+export enum AuthType {
+  password,
+  privateKey,
 }
 
 interface DBReducerPayloadType {
@@ -165,7 +174,8 @@ export type DBReducerActionType =
         | ActionType.queryChange
         | ActionType.inputChange
         | ActionType.editorChange
-        | ActionType.parametersChange;
+        | ActionType.parametersChange
+        | ActionType.parametersSSHTunnelChange;
       payload: DBReducerPayloadType;
     }
   | {
@@ -183,7 +193,10 @@ export type DBReducerActionType =
       };
     }
   | {
-      type: ActionType.reset | ActionType.addTableCatalogSheet;
+      type:
+        | ActionType.reset
+        | ActionType.addTableCatalogSheet
+        | ActionType.removeSSHTunnelConfig;
     }
   | {
       type: ActionType.removeTableCatalogSheet;
@@ -198,6 +211,12 @@ export type DBReducerActionType =
         engine?: string;
         configuration_method: CONFIGURATION_METHOD;
       };
+    }
+  | {
+      type: ActionType.setSSHTunnelLoginMethod;
+      payload: {
+        login_method: AuthType;
+      };
     };
 
 const StyledBtns = styled.div`
@@ -339,6 +358,42 @@ export function dbReducer(
         },
       };
 
+    case ActionType.parametersSSHTunnelChange:
+      return {
+        ...trimmedState,
+        ssh_tunnel: {
+          ...trimmedState.ssh_tunnel,
+          [action.payload.name]: action.payload.value,
+        },
+      };
+    case ActionType.setSSHTunnelLoginMethod:
+      if (action.payload.login_method === AuthType.privateKey) {
+        const { password, ...rest } = trimmedState?.ssh_tunnel ?? {};
+        return {
+          ...trimmedState,
+          ssh_tunnel: {
+            ...rest,
+          },
+        };
+      }
+      if (action.payload.login_method === AuthType.password) {
+        const { private_key, private_key_password, ...rest } =
+          trimmedState?.ssh_tunnel ?? {};
+        return {
+          ...trimmedState,
+          ssh_tunnel: {
+            ...rest,
+          },
+        };
+      }
+      return {
+        ...trimmedState,
+      };
+    case ActionType.removeSSHTunnelConfig:
+      return {
+        ...trimmedState,
+        ssh_tunnel: undefined,
+      };
     case ActionType.addTableCatalogSheet:
       if (trimmedState.catalog !== undefined) {
         return {
@@ -415,6 +470,7 @@ export function dbReducer(
         engine: action.payload.backend || trimmedState.engine,
         configuration_method: action.payload.configuration_method,
         parameters: action.payload.parameters || trimmedState.parameters,
+        ssh_tunnel: action.payload.ssh_tunnel || trimmedState.ssh_tunnel,
         query_input,
       };
 
@@ -487,6 +543,13 @@ const DatabaseModal: FunctionComponent<DatabaseModalProps> = ({
   const sslForced = isFeatureEnabled(
     FeatureFlag.FORCE_DATABASE_CONNECTIONS_SSL,
   );
+  const engineAllowsSSHTunneling = (
+    availableDbs?.databases?.find(
+      (DB: DatabaseObject) =>
+        DB.backend === db?.engine || DB.engine === db?.engine,
+    ) as DatabaseObject
+  )?.engine_information?.allow_ssh_tunneling;
+  const sshTunneling = isFeatureEnabled(FeatureFlag.SSH_TUNNELING);
   const hasAlert =
     connectionAlert || !!(db?.engine && engineSpecificAlertMapping[db.engine]);
   const useSqlAlchemyForm =
@@ -521,6 +584,7 @@ const DatabaseModal: FunctionComponent<DatabaseModalProps> = ({
       extra: db?.extra,
       masked_encrypted_extra: db?.masked_encrypted_extra || '',
       server_cert: db?.server_cert || undefined,
+      ssh_tunnel: db?.ssh_tunnel || undefined,
     };
     setTestInProgress(true);
     testDatabaseConnection(
@@ -1428,7 +1492,38 @@ const DatabaseModal: FunctionComponent<DatabaseModalProps> = ({
                 conf={conf}
                 testConnection={testConnection}
                 testInProgress={testInProgress}
-              />
+              >
+                {sshTunneling && engineAllowsSSHTunneling && (
+                  <SSHTunnelForm
+                    isEditMode={isEditMode}
+                    sshTunneling={sshTunneling}
+                    db={db as DatabaseObject}
+                    dbFetched={dbFetched as DatabaseObject}
+                    onSSHTunnelParametersChange={({
+                      target,
+                    }: {
+                      target: HTMLInputElement | HTMLTextAreaElement;
+                    }) =>
+                      onChange(ActionType.parametersSSHTunnelChange, {
+                        type: target.type,
+                        name: target.name,
+                        value: target.value,
+                      })
+                    }
+                    setSSHTunnelLoginMethod={(method: AuthType) =>
+                      setDB({
+                        type: ActionType.setSSHTunnelLoginMethod,
+                        payload: { login_method: method },
+                      })
+                    }
+                    removeSSHTunnelConfig={() =>
+                      setDB({
+                        type: ActionType.removeSSHTunnelConfig,
+                      })
+                    }
+                  />
+                )}
+              </SqlAlchemyForm>
               {isDynamic(db?.backend || db?.engine) && !isEditMode && (
                 <div css={(theme: SupersetTheme) => infoTooltip(theme)}>
                   <Button
diff --git a/superset-frontend/src/views/CRUD/data/database/types.ts b/superset-frontend/src/views/CRUD/data/database/types.ts
index 18b7eabff21dd..07c828090ffcb 100644
--- a/superset-frontend/src/views/CRUD/data/database/types.ts
+++ b/superset-frontend/src/views/CRUD/data/database/types.ts
@@ -26,6 +26,16 @@ export type CatalogObject = {
   value: string;
 };
 
+export type SSHTunnelObject = {
+  id?: number;
+  server_address?: string;
+  server_port?: number;
+  username?: string;
+  password?: string;
+  private_key?: string;
+  private_key_password?: string;
+};
+
 export type DatabaseObject = {
   // Connection + general
   backend?: string;
@@ -88,7 +98,11 @@ export type DatabaseObject = {
   // DB Engine Spec information
   engine_information?: {
     supports_file_upload?: boolean;
+    allow_ssh_tunneling?: boolean;
   };
+
+  // SSH Tunnel information
+  ssh_tunnel?: SSHTunnelObject;
 };
 
 export type DatabaseForm = {
@@ -139,6 +153,40 @@ export type DatabaseForm = {
     required: string[];
     type: string;
   };
+  ssh_tunnel: {
+    properties: {
+      ssh_address: {
+        description: string;
+        type: string;
+      };
+      ssh_port: {
+        description: string;
+        format: string;
+        type: string;
+      };
+      username: {
+        description: string;
+        type: string;
+      };
+      password: {
+        description: string;
+        nullable: boolean;
+        type: string;
+      };
+      private_key: {
+        description: string;
+        nullable: boolean;
+        type: string;
+      };
+      private_key_password: {
+        description: string;
+        nullable: boolean;
+        type: string;
+      };
+    };
+    required: string[];
+    type: string;
+  };
   preferred: boolean;
   sqlalchemy_uri_placeholder: string;
 };
diff --git a/superset/databases/api.py b/superset/databases/api.py
index 1c75204f79643..e04261b847a24 100644
--- a/superset/databases/api.py
+++ b/superset/databases/api.py
@@ -1150,6 +1150,9 @@ def available(self) -> Response:
                             supports_file_upload:
                               description: Whether the engine supports file uploads
                               type: boolean
+                            allow_ssh_tunneling:
+                              description: Whether the engine supports SSH Tunnels
+                              type: boolean
             400:
               $ref: '#/components/responses/400'
             500:
diff --git a/superset/databases/commands/test_connection.py b/superset/databases/commands/test_connection.py
index 8027efcb49a47..5f3affa39b903 100644
--- a/superset/databases/commands/test_connection.py
+++ b/superset/databases/commands/test_connection.py
@@ -32,6 +32,7 @@
     DatabaseTestConnectionUnexpectedError,
 )
 from superset.databases.dao import DatabaseDAO
+from superset.databases.ssh_tunnel.dao import SSHTunnelDAO
 from superset.databases.ssh_tunnel.models import SSHTunnel
 from superset.databases.utils import make_url_safe
 from superset.errors import ErrorLevel, SupersetErrorType
@@ -42,6 +43,7 @@
 )
 from superset.extensions import event_logger
 from superset.models.core import Database
+from superset.utils.ssh_tunnel import unmask_password_info
 
 logger = logging.getLogger(__name__)
 
@@ -93,6 +95,13 @@ def run(self) -> None:  # pylint: disable=too-many-statements
 
             # Generate tunnel if present in the properties
             if ssh_tunnel := self._properties.get("ssh_tunnel"):
+                # If there's an existing tunnel for that DB we need to use the stored
+                # password, private_key and private_key_password instead
+                if ssh_tunnel_id := ssh_tunnel.pop("id", None):
+                    if existing_ssh_tunnel := SSHTunnelDAO.find_by_id(ssh_tunnel_id):
+                        ssh_tunnel = unmask_password_info(
+                            ssh_tunnel, existing_ssh_tunnel
+                        )
                 ssh_tunnel = SSHTunnel(**ssh_tunnel)
 
             event_logger.log_with_context(
diff --git a/superset/databases/schemas.py b/superset/databases/schemas.py
index 1732b01ecc2a2..8ad2ab706fb2f 100644
--- a/superset/databases/schemas.py
+++ b/superset/databases/schemas.py
@@ -366,6 +366,7 @@ class Meta:  # pylint: disable=too-few-public-methods
 
 
 class DatabaseSSHTunnel(Schema):
+    id = fields.Integer(allow_none=True, description="SSH Tunnel ID (for updates)")
     server_address = fields.String()
     server_port = fields.Integer()
     username = fields.String()
diff --git a/superset/databases/ssh_tunnel/commands/update.py b/superset/databases/ssh_tunnel/commands/update.py
index 8d2feaf1b0d52..2ac7856705401 100644
--- a/superset/databases/ssh_tunnel/commands/update.py
+++ b/superset/databases/ssh_tunnel/commands/update.py
@@ -42,7 +42,8 @@ def __init__(self, model_id: int, data: Dict[str, Any]):
     def run(self) -> Model:
         self.validate()
         try:
-            tunnel = SSHTunnelDAO.update(self._model, self._properties)
+            if self._model is not None:  # So we dont get incompatible types error
+                tunnel = SSHTunnelDAO.update(self._model, self._properties)
         except DAOUpdateFailedError as ex:
             raise SSHTunnelUpdateFailedError() from ex
         return tunnel
diff --git a/superset/databases/ssh_tunnel/dao.py b/superset/databases/ssh_tunnel/dao.py
index 924148164482b..89562fc05dcc0 100644
--- a/superset/databases/ssh_tunnel/dao.py
+++ b/superset/databases/ssh_tunnel/dao.py
@@ -15,12 +15,35 @@
 # specific language governing permissions and limitations
 # under the License.
 import logging
+from typing import Any, Dict
 
 from superset.dao.base import BaseDAO
 from superset.databases.ssh_tunnel.models import SSHTunnel
+from superset.utils.ssh_tunnel import unmask_password_info
 
 logger = logging.getLogger(__name__)
 
 
 class SSHTunnelDAO(BaseDAO):
     model_cls = SSHTunnel
+
+    @classmethod
+    def update(
+        cls,
+        model: SSHTunnel,
+        properties: Dict[str, Any],
+        commit: bool = True,
+    ) -> SSHTunnel:
+        """
+        Unmask ``password``, ``private_key`` and ``private_key_password`` before updating.
+
+        When a database is edited the user sees a masked version of
+        the aforementioned fields.
+
+        The masked values should be unmasked before the ssh tunnel is updated.
+        """
+        # ID cannot be updated so we remove it if present in the payload
+        properties.pop("id", None)
+        properties = unmask_password_info(properties, model)
+
+        return super().update(model, properties, commit)
diff --git a/superset/databases/ssh_tunnel/models.py b/superset/databases/ssh_tunnel/models.py
index 79e8b918d9e17..727b6ea467c6a 100644
--- a/superset/databases/ssh_tunnel/models.py
+++ b/superset/databases/ssh_tunnel/models.py
@@ -23,6 +23,7 @@
 from sqlalchemy.orm import backref, relationship
 from sqlalchemy_utils import EncryptedType
 
+from superset.constants import PASSWORD_MASK
 from superset.models.core import Database
 from superset.models.helpers import (
     AuditMixinNullable,
@@ -69,8 +70,16 @@ class SSHTunnel(Model, AuditMixinNullable, ExtraJSONMixin, ImportExportMixin):
 
     @property
     def data(self) -> Dict[str, Any]:
-        return {
+        output = {
+            "id": self.id,
             "server_address": self.server_address,
             "server_port": self.server_port,
             "username": self.username,
         }
+        if self.password is not None:
+            output["password"] = PASSWORD_MASK
+        if self.private_key is not None:
+            output["private_key"] = PASSWORD_MASK
+        if self.private_key_password is not None:
+            output["private_key_password"] = PASSWORD_MASK
+        return output
diff --git a/superset/db_engine_specs/base.py b/superset/db_engine_specs/base.py
index a2a98ee6c0e1b..481ef5796ad83 100644
--- a/superset/db_engine_specs/base.py
+++ b/superset/db_engine_specs/base.py
@@ -1696,9 +1696,11 @@ def get_public_information(cls) -> Dict[str, Any]:
         Construct a Dict with properties we want to expose.
 
         :returns: Dict with properties of our class like supports_file_upload
+        and allow_ssh_tunneling
         """
         return {
             "supports_file_upload": cls.supports_file_upload,
+            "allow_ssh_tunneling": cls.allow_ssh_tunneling,
         }
 
 
diff --git a/superset/utils/ssh_tunnel.py b/superset/utils/ssh_tunnel.py
index 6562a8bbb570a..48ada98dccaaf 100644
--- a/superset/utils/ssh_tunnel.py
+++ b/superset/utils/ssh_tunnel.py
@@ -18,6 +18,7 @@
 from typing import Any, Dict
 
 from superset.constants import PASSWORD_MASK
+from superset.databases.ssh_tunnel.models import SSHTunnel
 
 
 def mask_password_info(ssh_tunnel: Dict[str, Any]) -> Dict[str, Any]:
@@ -28,3 +29,15 @@ def mask_password_info(ssh_tunnel: Dict[str, Any]) -> Dict[str, Any]:
     if ssh_tunnel.pop("private_key_password", None) is not None:
         ssh_tunnel["private_key_password"] = PASSWORD_MASK
     return ssh_tunnel
+
+
+def unmask_password_info(
+    ssh_tunnel: Dict[str, Any], model: SSHTunnel
+) -> Dict[str, Any]:
+    if ssh_tunnel.get("password") == PASSWORD_MASK:
+        ssh_tunnel["password"] = model.password
+    if ssh_tunnel.get("private_key") == PASSWORD_MASK:
+        ssh_tunnel["private_key"] = model.private_key
+    if ssh_tunnel.get("private_key_password") == PASSWORD_MASK:
+        ssh_tunnel["private_key_password"] = model.private_key_password
+    return ssh_tunnel
diff --git a/tests/integration_tests/databases/api_tests.py b/tests/integration_tests/databases/api_tests.py
index aeb74ec91e4f8..4835578dc27d6 100644
--- a/tests/integration_tests/databases/api_tests.py
+++ b/tests/integration_tests/databases/api_tests.py
@@ -318,6 +318,7 @@ def test_create_database_with_ssh_tunnel(
             .filter(SSHTunnel.database_id == response.get("id"))
             .one()
         )
+        self.assertEqual(response.get("result")["ssh_tunnel"]["password"], "XXXXXXXXXX")
         self.assertEqual(model_ssh_tunnel.database_id, response.get("id"))
         # Cleanup
         model = db.session.query(Database).get(response.get("id"))
@@ -404,6 +405,7 @@ def test_update_ssh_tunnel_via_database_api(
             "server_address": "123.132.123.1",
             "server_port": 8080,
             "username": "Test",
+            "password": "new_bar",
         }
         database_data_with_ssh_tunnel = {
             "database_name": "test-db-with-ssh-tunnel",
@@ -437,6 +439,9 @@ def test_update_ssh_tunnel_via_database_api(
             .one()
         )
         self.assertEqual(model_ssh_tunnel.database_id, response_update.get("id"))
+        self.assertEqual(
+            response_update.get("result")["ssh_tunnel"]["password"], "XXXXXXXXXX"
+        )
         self.assertEqual(model_ssh_tunnel.username, "Test")
         self.assertEqual(model_ssh_tunnel.server_address, "123.132.123.1")
         self.assertEqual(model_ssh_tunnel.server_port, 8080)
@@ -2299,6 +2304,7 @@ def test_available(self, app, get_available_engine_specs):
                     "sqlalchemy_uri_placeholder": "postgresql://user:password@host:port/dbname[?key=value&key=value...]",
                     "engine_information": {
                         "supports_file_upload": True,
+                        "allow_ssh_tunneling": True,
                     },
                 },
                 {
@@ -2321,6 +2327,7 @@ def test_available(self, app, get_available_engine_specs):
                     "sqlalchemy_uri_placeholder": "bigquery://{project_id}",
                     "engine_information": {
                         "supports_file_upload": True,
+                        "allow_ssh_tunneling": False,
                     },
                 },
                 {
@@ -2372,6 +2379,7 @@ def test_available(self, app, get_available_engine_specs):
                     "sqlalchemy_uri_placeholder": "redshift+psycopg2://user:password@host:port/dbname[?key=value&key=value...]",
                     "engine_information": {
                         "supports_file_upload": True,
+                        "allow_ssh_tunneling": False,
                     },
                 },
                 {
@@ -2394,6 +2402,7 @@ def test_available(self, app, get_available_engine_specs):
                     "sqlalchemy_uri_placeholder": "gsheets://",
                     "engine_information": {
                         "supports_file_upload": False,
+                        "allow_ssh_tunneling": False,
                     },
                 },
                 {
@@ -2445,6 +2454,7 @@ def test_available(self, app, get_available_engine_specs):
                     "sqlalchemy_uri_placeholder": "mysql://user:password@host:port/dbname[?key=value&key=value...]",
                     "engine_information": {
                         "supports_file_upload": True,
+                        "allow_ssh_tunneling": False,
                     },
                 },
                 {
@@ -2454,6 +2464,7 @@ def test_available(self, app, get_available_engine_specs):
                     "preferred": False,
                     "engine_information": {
                         "supports_file_upload": True,
+                        "allow_ssh_tunneling": False,
                     },
                 },
             ]
@@ -2484,6 +2495,7 @@ def test_available_no_default(self, app, get_available_engine_specs):
                     "preferred": True,
                     "engine_information": {
                         "supports_file_upload": True,
+                        "allow_ssh_tunneling": False,
                     },
                 },
                 {
@@ -2493,6 +2505,7 @@ def test_available_no_default(self, app, get_available_engine_specs):
                     "preferred": False,
                     "engine_information": {
                         "supports_file_upload": True,
+                        "allow_ssh_tunneling": False,
                     },
                 },
             ]