Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I visit my web URL and force port 3306 (MySQL), I see a suspicious looking web page:

enter image description here

Is this exposing any vulnerabilities for me? Should I block port 3306?

share|improve this question
6  
Are you asking whether having MySQL exposed is a vulnerability, or whether the gibberish it displays in a web browser is a vulnerability? – immibis Jan 12 at 9:20
    
Good question - I was asking about both, I suppose. Though I was originally asking more about the fact that it's exposed – Martin Jan 13 at 5:17
up vote 16 down vote accepted

I see two options here:

Local Access Only

Configure MySQL Server to only listen on TCP port 3306 on 127.0.0.1 (localhost). This way an internal web server can still communicate with the database server.

Directly connecting to the database is server is no longer available but can be solved by SSH tunneling (as described in mk444's answer)

This can be achieved by editing the my.cnf file. Search for "listen", most likely it is set to something like:

listen 0.0.0.0:3306

This should be changed to:

listen 127.0.0.1:3306

Don't forget to restart the MySQL server before changes take effect.

Restricted Remote Access

Another option is to keep the configuration the way it is and use iptables to block all incoming connections to TCP port 3306 with the exception of your (home) IP address.

Both options will work, however, from experience I know that often iptables-persistent is not used. Meaning that if you web / database server reboots the iptables rule set gets lost and TCP port 3306 is widely open for the outside world again.

share|improve this answer
2  
I'm a fool. The only reason I could see that page at all is because I white listed my IP as being allowed to remotely access MySQL - other computers get blocked – Martin Jan 12 at 18:32

If it's not required then definitely remove that service. It's a possible entry point for attackers and you can see the MySQL version number. The first thing that comes to mind is performing some Nmap scans, vuln-scans, mysql-brute, etc...

If you need to use this service there are some good answers in this serverfault post: https://serverfault.com/questions/283172/is-it-safe-to-open-port-3306-in-firewall-for-external-mysql-connection

An alternative solution is to create a ssh tunnel from your machine so that you can connect locally. Here's a good article on how you can create a ssh tunnel with MySQL. http://www.howtogeek.com/howto/ubuntu/access-your-mysql-server-remotely-over-ssh/

share|improve this answer
    
Yeah I need that. It's MySQL, and there are web apps on the server. Can I maybe block it from outsiders? – Martin Jan 12 at 5:04
    
post has been updated. – mk444 Jan 12 at 5:11
1  
@Martin you most definitely don't need that if there are apps on the server. You only need loopback access to MySQL. Exposing the MySQL CLI to the whole world is almost without exception a Really Bad Idea (TM). – Boris the Spider Jan 12 at 15:31
3  
What do you mean by web apps? Even when the webserver needs to access the mysql, and the world accesses the webserver, the world does not need access to mysql. – Lenne Jan 12 at 15:41
    
You guys are right - and actually the only way I can view that is from my house which I white listed as ok for remote access. Kind of a non issue – Martin Jan 12 at 18:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.