2

Hello I am looking for some advice. For an Advanced C++ Programming Course I am taking another student and doing a project. For this project we plan on using a MySQL Database as our backend database.I would like to setup a remotely accessible MySQL Database that we can use for the project such that we can be using the same database to test our programs ,also this way we can use the computers in the computer lab to program on, since we won't have to bring a computer with MySQL Installed on it to class to work on our program.

What I am worried about is the security of doing something like this, what I plan on doing is creating a database and a user. What I would like to do is to allow remote MySQL Connections to database from my user account and to restrict root logins to localhost (if I need to login to the database as root I can SSH to my Unix Server and then login as mysql root locally so the traffic will be encrypted) . what I am looking for is some advice on how I can best secure this database.

I don't plan on using SSL to login to the database as "user" from our program since this will require even more third party libraries (OpenSSL) be added to our project and I really to keep the number of libraries we are using down.

What I am looking for is some advice on how I can best secure this system. I will only be keeping it up for the semester and will be taking it down and re imaging it when I am done. It is going to be located on a DMZ with the only other host on the network being an OpenBSD web server that I am running.

I plan on using the mysql_secure_installation script that is included with MySQL Server on OpenBSD when I set it up so that test users and databases are removed is there anything else I should do other than keep the system patched, not allow root logins remotely and use strong passwords?

Thank you for taking the time to answer my question

Improve this question
2
  • Frankly, the easiest method will probably be to keep the database accessible only within the intranet and requiring a VPN connection into the intranet to access it.
    – user10211
    Sep 16, 2013 at 0:46
  • First off thank you for commenting! The only problem with this is on the lab computers we do not have OpenVPN installed on the computers and isn't administrative access required to install OpenVPN specifically the tap driver I believe (even from a portable version on a usb drive) even though administrative privileges are not required to actually run openvpn
    – crooked
    Sep 16, 2013 at 1:47

1 Answer 1

Reset to default
2

the easiest way, if all machines are linux/unix-based, is to create ssh-tunnels (sometimes called 'poor mans vpn') from every machine onto your mysql-server;

  • no need to open ports to the outside
  • no need to create additional users
  • no need to change mysql access-permission locally
  • you can work with ssh-keys
  • data-transfer is encrypted

ssh -p 22 -L 3306:127.0.0.1:3306 user@mysql-server -N

this will start a tunnel and make mysql @ mysql-server locally available @ localhost:3306

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .