9

If I visit my web URL and force port 3306 (MySQL), I see a suspicious looking web page:

enter image description here

Is this exposing any vulnerabilities for me? Should I block port 3306?

  • 7
    Are you asking whether having MySQL exposed is a vulnerability, or whether the gibberish it displays in a web browser is a vulnerability? – immibis Jan 12 '16 at 9:20
  • Good question - I was asking about both, I suppose. Though I was originally asking more about the fact that it's exposed – Martin Jan 13 '16 at 5:17
18

I see two options here:

Local Access Only

Configure MySQL Server to only listen on TCP port 3306 on 127.0.0.1 (localhost). This way an internal web server can still communicate with the database server.

Directly connecting to the database is server is no longer available but can be solved by SSH tunneling (as described in mk444's answer)

This can be achieved by editing the my.cnf file. Search for "listen", most likely it is set to something like:

listen 0.0.0.0:3306

This should be changed to:

listen 127.0.0.1:3306

Don't forget to restart the MySQL server before changes take effect.

Restricted Remote Access

Another option is to keep the configuration the way it is and use iptables to block all incoming connections to TCP port 3306 with the exception of your (home) IP address.

Both options will work, however, from experience I know that often iptables-persistent is not used. Meaning that if you web / database server reboots the iptables rule set gets lost and TCP port 3306 is widely open for the outside world again.

  • 4
    I'm a fool. The only reason I could see that page at all is because I white listed my IP as being allowed to remotely access MySQL - other computers get blocked – Martin Jan 12 '16 at 18:32
4

If it's not required then definitely remove that service. It's a possible entry point for attackers and you can see the MySQL version number. The first thing that comes to mind is performing some Nmap scans, vuln-scans, mysql-brute, etc...

If you need to use this service there are some good answers in this serverfault post: https://serverfault.com/questions/283172/is-it-safe-to-open-port-3306-in-firewall-for-external-mysql-connection

An alternative solution is to create a ssh tunnel from your machine so that you can connect locally. Here's a good article on how you can create a ssh tunnel with MySQL. http://www.howtogeek.com/howto/ubuntu/access-your-mysql-server-remotely-over-ssh/

  • Yeah I need that. It's MySQL, and there are web apps on the server. Can I maybe block it from outsiders? – Martin Jan 12 '16 at 5:04
  • post has been updated. – mk444 Jan 12 '16 at 5:11
  • 1
    @Martin you most definitely don't need that if there are apps on the server. You only need loopback access to MySQL. Exposing the MySQL CLI to the whole world is almost without exception a Really Bad Idea (TM). – Boris the Spider Jan 12 '16 at 15:31
  • 3
    What do you mean by web apps? Even when the webserver needs to access the mysql, and the world accesses the webserver, the world does not need access to mysql. – Lenne Jan 12 '16 at 15:41
  • You guys are right - and actually the only way I can view that is from my house which I white listed as ok for remote access. Kind of a non issue – Martin Jan 12 '16 at 18:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.