3

I'm looking for a secure way to access a MySQL database. I'm currently using PHPMyAdmin but wondering if it would be better to use a desktop client and restrict access to only the IP addresses I know I will be accessing from.

Does anyone have any thoughts on the best way to go?

3
  • 4
    You can restrict PHPMyAdmin by IP too.
    – Simon
    Aug 7, 2013 at 13:30
  • I assume that needs to be done in the apache config file rather than through PHPMyAdmin?
    – williamsdb
    Aug 8, 2013 at 6:54
  • For example on Ubuntu the file is apache.conf is /etc/phpmyadmin. You would type something like: Order deny, allow deny from all allow from xx.xx.xx.xx
    – Simon
    Aug 8, 2013 at 12:42

4 Answers 4

4

Sequel Pro offers some interesting connection methods that you just don't have with PHPMyAdmin.

With Sequel Pro you can connect to your MySQL Server via SSH. This means you can take advantage of the private/public keypair connection of your OS (that's heaps better than passwords).

private/public keypair is a better login option than passwords (so using SSH via Sequel Pro would be more secure than using passwords with PHPMyAdmin).

If you do want to use PHPMyAdmin you should consider these points:

  • Consider using HTTP Basic Auth in front of PHPMyAdmin
  • Always restrict access to only your IP Address if you can (this can help cut down on a number of login attempts)
  • PHPMyAdmin needs to be secured, and kept up to date
  • don't have predictable file locations such as /PHPMyAdmin (this cuts down on the attempts from automated scanners)
  • Make sure you use HTTPS
  • PHPMyAdmin configuration can store credentials, these could be compromised
5
  • Thanks, some good points made. I don't think that PHPMyAdmin can handle private/public keypair authentication can it?
    – williamsdb
    Aug 7, 2013 at 9:48
  • No it can't, that's my point. I'll make it more obvious in my answer. Aug 7, 2013 at 9:53
  • you can connect to your MySQL Server via SSH - MySQL supports SSL encryption including client certificate validation (and PHPMyAdmin can be configured to use SSL on the DB connection). Any TCP conection can be wrapped in an ssh or ssl tunnel (latter using stunnel or stud). Hence support for ssh tunnelling is only really a benefit if you only have half the infrastructure to support ssh.
    – symcbean
    Aug 7, 2013 at 10:42
  • With Sequel Pro you connect to your OS via SSH, from there you log into MySQL with a username and password. This way your login is protected by the SSH connection to your machine and your MySQL login happens locally. Aug 7, 2013 at 10:46
  • Most MySQL tools such as NaviCat have SSH tunneling built in so you don't have to expose an unsecured, unencrypted MySQL port to the universe. It connects with SSH and then tunnels to a localhost MySQL connection on the remote server. Aug 28, 2013 at 13:50
3

MySQL-Workbench + SSH-Keys + SSH-Tunnel; tunnel might be established from within MySQL-Workbench

if you NEED to have phpmyadmin:

  • put it in a subdomain
  • be sure to have htaccess-protection infront of it
  • use ssl, if available
  • use IP-restriction, if available

but my favs are always workbench + ssh-tunnel; no additional software, no addtional stuff to think and care about

2

Using the IP address as an authentication token is not a great security solution. (I should add that that its a very good idea to exclude IP addresses/ports you know should not have access to a system - if only to cut down on the noise).

Using HTTPS (compared with an SSL encrypted MySQL connection) gives you a lot more control over access (e.g. using client side certificates). And it avoids the complication of maintaining multiple clients.

2
  • Not sure that I understand the answer or maybe I wasn't clear in my question. I am talking about only allowing remote access to MySQL for a known list of IP addresses and then using a client such as Sequel Pro on my Mac to access - you still have to use a username and password to access - it's not open access. PHPMyAdmin is already on a https connection but login page is open to all to have a crack at guessing the (secure as it can be) password.
    – williamsdb
    Aug 7, 2013 at 9:03
  • 1
    Perhaps I wasn't clear in my answer - restricting to a known list of IPs means that the IP address is being used as an authentication token - albeit that there may be other tokens required for access - and relying on authentication tokens as the only protection mechanism still means that the data exchanges are subject to capture/injection.
    – symcbean
    Aug 7, 2013 at 10:45
1

SQLyog is also one of an option i feel. It has an option to connect with SSH.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .