1

I need to be able to remotely modify my SQL database. There are two ways:

  1. A PHPMyAdmin like interface (write scripts which will do it)

  2. Let the SQL Server through the firewall (so it listens on the Internet)

  3. Is hard as my (Windows) box doesn't support PHP

Are SQL servers hardened for Internet use?

PS.: I don't have SSL, so the passwords go in the clear anyway.

  • "3. Is hard" Should be read as Option one is hard... – user92831 Nov 24 '15 at 19:49
  • Did you have a look at this question answered earlier? The answer refers to a sql-server alternative of mysqladmin. – Prahlad Yeri Nov 24 '15 at 19:52
  • 3
    No SSL basically means no security. – Neil Smithline Nov 24 '15 at 19:58
  • 3
    If you authenticate in the clear, then there is no point discussing further security. You've transmitted all the information necessary to perform any database action in the clear. Take a look at federated authentication, tunneling, proxies etc. Find a way to secure that authentication or accept that you have no control over your data. – Mark C. Wallace Nov 24 '15 at 20:08
1

The following would probably be considered "okay" around here:

  1. Add another NIC on your db server
  2. Connect it to a distinct management network
  3. Remotely connect to this management network using a VPN, with client IP restrictions.

PHP runs on Windows, however you should modify your database with change-log scripts, like with liquibase.

  • 1
    Not sure about "OK". Yes, done properly, this is a secure solution, but there is a lot of scope for doing this wrong. – symcbean Nov 24 '15 at 23:07
0

Assuming you are running MySQL or MS SQL Server on a windows platform, in the past, this is what I have done:

  1. Install Cygwin and a SSH daemon
  2. Start up a SSL tunnel using putty
  3. Use MS SQL Server Management Studio or MySQL Workbench to connect to localhost on the SSL tunneled local port
0

I would NEVER plug a Microsoft SQL Server directly into the internet. Even though MySQL has TLS (including client cert authentication) built in, I would still see this as a very last resort. The suggestion of using an SSH tunnel or VPN has its limitations. I would want to firewall and authenticate on a gateway device separate from the DBMS. A different service running on the same host would be adequate for low security environments but not if there is anything of value on the server where this should be on a separate host.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.