Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm looking to make a MySQL database on a VPS, accessible to my home PC through cPanel. cPanel wants the domain name or IP address of the remote machine. However, with standard DSL, I have a dynamic IP address.

Now, according to the docs, I can use a wildcard in the IP, so I could use 123.45.67.% as my authorized remote machine.

Assuming I pick a good password for the database, how much of a risk is it, to authorize a range of IP addresses to try and login? Otherwise my only option is to be constantly changing the authorized IP address.

share|improve this question
add comment

3 Answers

up vote 7 down vote accepted

You are extending your trust to outsiders beyond your subnet neighbors.

By default, MySQL uses unencrypted connections between the client and the server. This means that someone with access to the network could watch all your traffic and look at the data being sent or received. They could even change the data while it is in transit between client and server.

This, of course, means any device between you and the server and everyone with access to those devices (either authorized or unauthorized).

If the data is valuable then I would do more to ensure the security of it. Several options exist to help you secure all the traffic, including:

share|improve this answer
add comment

In descending order of security:

  • Establish a VPN and have MySQL listen only on the VPN interface
  • Use port knocking
  • Change your authorized IP
  • Leave it open

I wouldn't worry too much about the IP next to you. The odds of the next person in your neighborhood going after your SQL server are relatively low, so wildcarding a subnet should be fine. Options beyond that provide an extra level of security up to the VPN point. It really relates to how much you value your data and whether it is worth setting up the VPN configuration. If your access isn't server-to-server, ssh port forwarding may be a handy consideration.

Weigh your risk (based primarily on the value of your data) and consider how much work is worth it.

share|improve this answer
add comment

Is your VPS a linux system? If so, one port open is enough for everything, the port your ssh daemon runs on. Use ssh port forward and have other daemons listening on localhost.

share|improve this answer
    
Yup - it's important to encrypt the connection. Cpanel is far less secure, and you can access mysql directly over ssh via command line, and do web-based admin by forwarding an http port. –  nealmcb May 20 '11 at 4:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.