9

If I visit my web URL and force port 3306 (MySQL), I see a suspicious looking web page:

enter image description here

Is this exposing any vulnerabilities for me? Should I block port 3306?

Improve this question
2
  • 7
    Are you asking whether having MySQL exposed is a vulnerability, or whether the gibberish it displays in a web browser is a vulnerability?
    – user20574
    Commented Jan 12, 2016 at 9:20
  • Good question - I was asking about both, I suppose. Though I was originally asking more about the fact that it's exposed
    – xyhhx
    Commented Jan 13, 2016 at 5:17

2 Answers 2

Reset to default
18

I see two options here:

Local Access Only

Configure MySQL Server to only listen on TCP port 3306 on 127.0.0.1 (localhost). This way an internal web server can still communicate with the database server.

Directly connecting to the database is server is no longer available but can be solved by SSH tunneling (as described in mk444's answer)

This can be achieved by editing the my.cnf file. Search for "listen", most likely it is set to something like:

listen 0.0.0.0:3306

This should be changed to:

listen 127.0.0.1:3306

Don't forget to restart the MySQL server before changes take effect.

Restricted Remote Access

Another option is to keep the configuration the way it is and use iptables to block all incoming connections to TCP port 3306 with the exception of your (home) IP address.

Both options will work, however, from experience I know that often iptables-persistent is not used. Meaning that if you web / database server reboots the iptables rule set gets lost and TCP port 3306 is widely open for the outside world again.

Improve this answer
1
  • 4
    I'm a fool. The only reason I could see that page at all is because I white listed my IP as being allowed to remotely access MySQL - other computers get blocked
    – xyhhx
    Commented Jan 12, 2016 at 18:32
4

If it's not required then definitely remove that service. It's a possible entry point for attackers and you can see the MySQL version number. The first thing that comes to mind is performing some Nmap scans, vuln-scans, mysql-brute, etc...

If you need to use this service there are some good answers in this serverfault post: https://serverfault.com/questions/283172/is-it-safe-to-open-port-3306-in-firewall-for-external-mysql-connection

An alternative solution is to create a ssh tunnel from your machine so that you can connect locally. Here's a good article on how you can create a ssh tunnel with MySQL. http://www.howtogeek.com/howto/ubuntu/access-your-mysql-server-remotely-over-ssh/

Improve this answer
5
  • Yeah I need that. It's MySQL, and there are web apps on the server. Can I maybe block it from outsiders?
    – xyhhx
    Commented Jan 12, 2016 at 5:04
  • post has been updated.
    – 16b7195abb140a3929bbc322d1c6f1
    Commented Jan 12, 2016 at 5:11
  • 1
    @Martin you most definitely don't need that if there are apps on the server. You only need loopback access to MySQL. Exposing the MySQL CLI to the whole world is almost without exception a Really Bad Idea (TM).
    – Boris the Spider
    Commented Jan 12, 2016 at 15:31
  • 3
    What do you mean by web apps? Even when the webserver needs to access the mysql, and the world accesses the webserver, the world does not need access to mysql.
    – Lenne
    Commented Jan 12, 2016 at 15:41
  • You guys are right - and actually the only way I can view that is from my house which I white listed as ok for remote access. Kind of a non issue
    – xyhhx
    Commented Jan 12, 2016 at 18:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .