1

I know that having the MySQL 3306 port is unsafe even if you restrict the user access based on IP. But what if you really need remote access to your database ? Maybe two applications reading and updating data at the same time.

If we have two applications one on the same host as the database and another one remote what would be a viable and secure way of sharing the same data ? Should we host the database some other place ? Should we have two local databases for each application and keep them up-to-date ? What would you suggest ?

Improve this question
8
  • You can restrict it with firewalls, which can be dedicated boxes or operating system firewall.
    – Aria
    Aug 26, 2016 at 15:19
  • If I use a CSF Firewall for example to restrict the port wouldn't that also restrict my remote application from creating a connection ?
    – Stefan Idriceanu
    Aug 26, 2016 at 15:34
  • Yes, unless you explicitly allow the remote application's IP to connect (and deny all others). But it is the wrong solution to apply IMO-- now you are entirely dependent on your network admin for your application security, and one errant change to the firewall config can leave you wide open. Or it can interrupt your application.
    – Ivan
    Aug 26, 2016 at 15:45
  • I understand what you mean. At the moment I am both the developer and the network admin so it should not be a problem. Still it might cause problems in the future.
    – Stefan Idriceanu
    Aug 26, 2016 at 15:51
  • Just to beat a dead horse, I strongly recommend against going the firewall route. The above problem aside, the traffic to/from your DB is also unencrypted-- any DB requests traveling across the internet can be read in clear text. But if you use a VPN or SSH tunnel, it's all encrypted.
    – Ivan
    Aug 26, 2016 at 15:58

3 Answers 3

Reset to default
1

There are many options. If your applications are in a cloud environment, setup an internal network connection between the two. If this is available to you, go with this.

You could setup a VPN connection between the two machines, which is quite secure, but requires some configuration. Another, (in my opinion better) option would be to use a SSH tunnel or variants (SSL tunnel).

Improve this answer
2

Set up a VPN between both machines.

Improve this answer
2
  • 1
    Or, if budget is an issue, set up a persistent SSH tunnel. see also: autossh.
    – Ivan
    Aug 26, 2016 at 15:30
  • Thank you all for the suggestions, I have researched a little bit on both but I wanted to know what other people would suggest. You made a good point regarding the budget.
    – Stefan Idriceanu
    Aug 26, 2016 at 15:38
0

As said by other users, an alternative is a VPN connection. But for answer completion, a poor man alternative cloud be a SSH port forward.

ssh -L 3306:localhost:3306 [email protected]

Just connect to your localhost:3306 and enjoy your mysql connection. But remember to only allow the connection for trusted hosts, or, if is a database that is only used by localhost, bind it to 127.0.0.1.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .