Risk of configuring MySQL for remote access with a dynamic IP address?

Question

I'm looking to make a MySQL database on a VPS, accessible to my home PC through cPanel. cPanel wants the domain name or IP address of the remote machine. However, with standard DSL, I have a dynamic IP address.

Now, according to the docs, I can use a wildcard in the IP, so I could use 123.45.67.% as my authorized remote machine.

Assuming I pick a good password for the database, how much of a risk is it, to authorize a range of IP addresses to try and login? Otherwise my only option is to be constantly changing the authorized IP address.

Answer 1

You are extending your trust to outsiders beyond your subnet neighbors.

By default, MySQL uses unencrypted connections between the client and the server. This means that someone with access to the network could watch all your traffic and look at the data being sent or received. They could even change the data while it is in transit between client and server.

This, of course, means any device between you and the server and everyone with access to those devices (either authorized or unauthorized).

If the data is valuable then I would do more to ensure the security of it. Several options exist to help you secure all the traffic, including:

• MySQL supports secure (encrypted) connections between MySQL clients and the server using the Secure Sockets Layer (SSL) protocol (http://dev.mysql.com/doc/refman/5.5/en/secure-connections.html)
• OpenVPN (http://openvpn.net/) and/or SSH tunneling (http://upshell.wordpress.com/2011/02/23/connecting-to-a-remote-mysql-server-securely-using-ssh-port-forwarding/), which are free. (options mentioned by @Jeff Ferland)

Answer 2

In descending order of security:

• Establish a VPN and have MySQL listen only on the VPN interface
• Use port knocking
• Change your authorized IP
• Leave it open

I wouldn't worry too much about the IP next to you. The odds of the next person in your neighborhood going after your SQL server are relatively low, so wildcarding a subnet should be fine. Options beyond that provide an extra level of security up to the VPN point. It really relates to how much you value your data and whether it is worth setting up the VPN configuration. If your access isn't server-to-server, ssh port forwarding may be a handy consideration.

Weigh your risk (based primarily on the value of your data) and consider how much work is worth it.

Answer 3

Is your VPS a linux system? If so, one port open is enough for everything, the port your ssh daemon runs on. Use ssh port forward and have other daemons listening on localhost.