Opening remote MySQL database to office IP address at default MySQL port risks?

Question

I read a few questions regarding this topic that were pretty informative, but still wanted to pose my particular case.

My company wants to put our data in the MySQL tables we have through our web hosting provider. We went into MySQL on the server and opened it to the static public IP at our office. However, the port is the default MySQL port.

I think the obvious risk is someone accessing those tables from our IP, but they would still need a couple of levels of usernames and passwords to get access. What are some other risks? We do have parts of our website in Python which are public facing and PHP which is the front-end in the office.

Answer 1

The main problem I see is that MySQL does by default not use any encryption so your username and password will be transferred in plaintext every time your or any application using the MySQL Server connects to the database. You can use MySQL with SSL Support, but that would require some extra work. You can have a look at this to determine if it's worth the work: https://dev.mysql.com/doc/refman/5.1/en/building-with-ssl-support.html

My suggestion is that you setup a MySQL Server on the Webserver and then use a socket which isn't only much more secure than establishing an unencrypted connection but also faster because you don't have to deal with the TCP/IP overhead. In my experience MySQL is easy to administer as long as you don't have really huge datasets.

Answer 2

Opening it to static public IP in firewall or MySQL settings does not mean that only packets from that IP can access it. It means that only packets claiming to be from that IP can access it.

See: IP Address Spoofing

I understand UDP packets have another angle on this. I would also only use SSL, for obvious reasons if going this route.

Disclaimer: I am not a security expert, but a hobbyist.