Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm looking for a secure way to access a MySQL database. I'm currently using PHPMyAdmin but wondering if it would be better to use a desktop client and restrict access to only the IP addresses I know I will be accessing from.

Does anyone have any thoughts on the best way to go?

share|improve this question
4  
You can restrict PHPMyAdmin by IP too. –  Simon Aug 7 '13 at 13:30
    
I assume that needs to be done in the apache config file rather than through PHPMyAdmin? –  williamsdb Aug 8 '13 at 6:54
    
For example on Ubuntu the file is apache.conf is /etc/phpmyadmin. You would type something like: Order deny, allow deny from all allow from xx.xx.xx.xx –  Simon Aug 8 '13 at 12:42
add comment

4 Answers

up vote 3 down vote accepted

Sequel Pro offers some interesting connection methods that you just don't have with PHPMyAdmin.

With Sequel Pro you can connect to your MySQL Server via SSH. This means you can take advantage of the private/public keypair connection of your OS (that's heaps better than passwords).

private/public keypair is a better login option than passwords (so using SSH via Sequel Pro would be more secure than using passwords with PHPMyAdmin).

If you do want to use PHPMyAdmin you should consider these points:

  • Consider using HTTP Basic Auth in front of PHPMyAdmin
  • Always restrict access to only your IP Address if you can (this can help cut down on a number of login attempts)
  • PHPMyAdmin needs to be secured, and kept up to date
  • don't have predictable file locations such as /PHPMyAdmin (this cuts down on the attempts from automated scanners)
  • Make sure you use HTTPS
  • PHPMyAdmin configuration can store credentials, these could be compromised
share|improve this answer
    
Thanks, some good points made. I don't think that PHPMyAdmin can handle private/public keypair authentication can it? –  williamsdb Aug 7 '13 at 9:48
    
No it can't, that's my point. I'll make it more obvious in my answer. –  Drew Khoury Aug 7 '13 at 9:53
    
you can connect to your MySQL Server via SSH - MySQL supports SSL encryption including client certificate validation (and PHPMyAdmin can be configured to use SSL on the DB connection). Any TCP conection can be wrapped in an ssh or ssl tunnel (latter using stunnel or stud). Hence support for ssh tunnelling is only really a benefit if you only have half the infrastructure to support ssh. –  symcbean Aug 7 '13 at 10:42
    
With Sequel Pro you connect to your OS via SSH, from there you log into MySQL with a username and password. This way your login is protected by the SSH connection to your machine and your MySQL login happens locally. –  Drew Khoury Aug 7 '13 at 10:46
    
Most MySQL tools such as NaviCat have SSH tunneling built in so you don't have to expose an unsecured, unencrypted MySQL port to the universe. It connects with SSH and then tunnels to a localhost MySQL connection on the remote server. –  Fiasco Labs Aug 28 '13 at 13:50
add comment

MySQL-Workbench + SSH-Keys + SSH-Tunnel; tunnel might be established from within MySQL-Workbench

if you NEED to have phpmyadmin:

  • put it in a subdomain
  • be sure to have htaccess-protection infront of it
  • use ssl, if available
  • use IP-restriction, if available

but my favs are always workbench + ssh-tunnel; no additional software, no addtional stuff to think and care about

share|improve this answer
add comment

Using the IP address as an authentication token is not a great security solution. (I should add that that its a very good idea to exclude IP addresses/ports you know should not have access to a system - if only to cut down on the noise).

Using HTTPS (compared with an SSL encrypted MySQL connection) gives you a lot more control over access (e.g. using client side certificates). And it avoids the complication of maintaining multiple clients.

share|improve this answer
    
Not sure that I understand the answer or maybe I wasn't clear in my question. I am talking about only allowing remote access to MySQL for a known list of IP addresses and then using a client such as Sequel Pro on my Mac to access - you still have to use a username and password to access - it's not open access. PHPMyAdmin is already on a https connection but login page is open to all to have a crack at guessing the (secure as it can be) password. –  williamsdb Aug 7 '13 at 9:03
1  
Perhaps I wasn't clear in my answer - restricting to a known list of IPs means that the IP address is being used as an authentication token - albeit that there may be other tokens required for access - and relying on authentication tokens as the only protection mechanism still means that the data exchanges are subject to capture/injection. –  symcbean Aug 7 '13 at 10:45
add comment

SQLyog is also one of an option i feel. It has an option to connect with SSH.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.