0

I recently wrote a small PHP script to get users that are online in my application, which uses MySQL and is hosted from my dedicated server. I use a popular web hosting company and had trouble connecting to my MySQL database from the script, so I contacted the web host and I was told this:

Sorry. We are unable to allow connections to external databases as it is a security risk.

The support representative was apparently unable to tell me what this 'security risk' is, and I can't think of any additional security risks accessing external database systems would bring as this particular host allows connections to the databases situated on their hosting platform.

I suspect that this could be a marketing tactic (that you must use their database servers), but is there any actual risk of accessing a remote database server?

  • 2
    I'd guess they block specific ports. You might be able to get round it by running the remote MySQL on port 443. – paj28 Aug 11 '16 at 21:13
  • @paj28 They won't unblock the port if it's for an external database server. – AStopher Aug 11 '16 at 21:15
  • why not just host the whole thing on a vps? They are getting ridiculously cheap these days. – CaffeineAddiction Aug 11 '16 at 21:30
  • @CaffeineAddiction Because I want all my websites in one place, instead of being split between my dedicated server and web-hosting. – AStopher Aug 11 '16 at 21:41
1

The only Security risk I can think of would be if one of the two servers where compromised and thus compromised the other.

Or possibly they are concerned about hosting content that they do not have physical control over.

But yes, I too suspect its a marketing ploy

1

While I suspect that CaffeineAddiction's thoughts about the provider wishing to protect their revenue streams and force you down their choice of an upgrade task may well be the case, it is also possible that the ISP is being honest. Although I think its unlikely they are concerned about serving up content they don't have physical control over.

Put yourself in their shoes. They provide the facility for lots of different people to run any code their customers can upload within their network. They want to limit the exposure of a customer's applications to provide some protection to it. And, in the event that one of their customers uploads some bug ridden, vulnerable service, ensure some sort of containment to limit the damage it might otherwise do.

A very effective way to do that is to limit the ability of such applications to create connections back out to the internet: blocking connections on the firewall and providing no external dns service is a good way to achieve that.

It also restricts the ability of attackers to use their facilities as an anonymization layer; 15 years ago most of the unsollicited traffic on my servers was probing for open mail relays. Today, it's probing for open http proxies.

  • This provider allows you to connect to their database servers from outside the network, so that's the 'protection' out of the window (if you were to really do that, then they wouldn't allow external connections to their own databases). – AStopher Aug 11 '16 at 23:47
  • @cybermonkey - no, that's different from what I describe - the client is still outside and the server inside the providers network. – symcbean Aug 12 '16 at 8:17
  • Yes.. but that's not what my question is about. – AStopher Aug 12 '16 at 13:13
  • You asked about your provider not allowing outward connections from the hosting to a database. Your comment here is about inward connections to a database. These are very different security problems and hence are not directly comparable. – symcbean Aug 12 '16 at 13:18
  • I interpreted your answer as inbound connections only, and not outbound (restricts the ability of attackers to use their facilities as an anonymization layer sounds like you're talking about restricting connectivity to their own database servers). – AStopher Aug 12 '16 at 13:26
0

One risk could be that your database is compromised and you store in some php code that get called using 'eval' function.

Yes i know you probably don't do that, but that's still a possibilty and there are probably more ways of compromised their server once yours is. And without access to your server, they won't be able to make it stop or even find from where it really comes. The only thing they would be able to do is what they're already doing : prevent the connection.

Another thing could be they don't want to support questions like 'it isn't working' when it comes from your server and not their.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.