1

I need to be able to remotely modify my SQL database. There are two ways:

  1. A PHPMyAdmin like interface (write scripts which will do it)

  2. Let the SQL Server through the firewall (so it listens on the Internet)

  3. Is hard as my (Windows) box doesn't support PHP

Are SQL servers hardened for Internet use?

PS.: I don't have SSL, so the passwords go in the clear anyway.

Improve this question
4
  • "3. Is hard" Should be read as Option one is hard...
    – user92831
    Commented Nov 24, 2015 at 19:49
  • Did you have a look at this question answered earlier? The answer refers to a sql-server alternative of mysqladmin.
    – Prahlad Yeri
    Commented Nov 24, 2015 at 19:52
  • 3
    No SSL basically means no security.
    – Neil Smithline
    Commented Nov 24, 2015 at 19:58
  • 3
    If you authenticate in the clear, then there is no point discussing further security. You've transmitted all the information necessary to perform any database action in the clear. Take a look at federated authentication, tunneling, proxies etc. Find a way to secure that authentication or accept that you have no control over your data.
    – MCW
    Commented Nov 24, 2015 at 20:08

3 Answers 3

Reset to default
1

The following would probably be considered "okay" around here:

  1. Add another NIC on your db server
  2. Connect it to a distinct management network
  3. Remotely connect to this management network using a VPN, with client IP restrictions.

PHP runs on Windows, however you should modify your database with change-log scripts, like with liquibase.

Improve this answer
1
  • 1
    Not sure about "OK". Yes, done properly, this is a secure solution, but there is a lot of scope for doing this wrong.
    – symcbean
    Commented Nov 24, 2015 at 23:07
0

Assuming you are running MySQL or MS SQL Server on a windows platform, in the past, this is what I have done:

  1. Install Cygwin and a SSH daemon
  2. Start up a SSL tunnel using putty
  3. Use MS SQL Server Management Studio or MySQL Workbench to connect to localhost on the SSL tunneled local port
Improve this answer
0

I would NEVER plug a Microsoft SQL Server directly into the internet. Even though MySQL has TLS (including client cert authentication) built in, I would still see this as a very last resort. The suggestion of using an SSH tunnel or VPN has its limitations. I would want to firewall and authenticate on a gateway device separate from the DBMS. A different service running on the same host would be adequate for low security environments but not if there is anything of value on the server where this should be on a separate host.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .