1

I know that having the MySQL 3306 port is unsafe even if you restrict the user access based on IP. But what if you really need remote access to your database ? Maybe two applications reading and updating data at the same time.

If we have two applications one on the same host as the database and another one remote what would be a viable and secure way of sharing the same data ? Should we host the database some other place ? Should we have two local databases for each application and keep them up-to-date ? What would you suggest ?

  • You can restrict it with firewalls, which can be dedicated boxes or operating system firewall. – Aria Aug 26 '16 at 15:19
  • If I use a CSF Firewall for example to restrict the port wouldn't that also restrict my remote application from creating a connection ? – Stefan Idriceanu Aug 26 '16 at 15:34
  • Yes, unless you explicitly allow the remote application's IP to connect (and deny all others). But it is the wrong solution to apply IMO-- now you are entirely dependent on your network admin for your application security, and one errant change to the firewall config can leave you wide open. Or it can interrupt your application. – Ivan Aug 26 '16 at 15:45
  • I understand what you mean. At the moment I am both the developer and the network admin so it should not be a problem. Still it might cause problems in the future. – Stefan Idriceanu Aug 26 '16 at 15:51
  • Just to beat a dead horse, I strongly recommend against going the firewall route. The above problem aside, the traffic to/from your DB is also unencrypted-- any DB requests traveling across the internet can be read in clear text. But if you use a VPN or SSH tunnel, it's all encrypted. – Ivan Aug 26 '16 at 15:58
1

There are many options. If your applications are in a cloud environment, setup an internal network connection between the two. If this is available to you, go with this.

You could setup a VPN connection between the two machines, which is quite secure, but requires some configuration. Another, (in my opinion better) option would be to use a SSH tunnel or variants (SSL tunnel).

2

Set up a VPN between both machines.

  • 1
    Or, if budget is an issue, set up a persistent SSH tunnel. see also: autossh. – Ivan Aug 26 '16 at 15:30
  • Thank you all for the suggestions, I have researched a little bit on both but I wanted to know what other people would suggest. You made a good point regarding the budget. – Stefan Idriceanu Aug 26 '16 at 15:38
0

As said by other users, an alternative is a VPN connection. But for answer completion, a poor man alternative cloud be a SSH port forward.

ssh -L 3306:localhost:3306 someuser@someserver.com

Just connect to your localhost:3306 and enjoy your mysql connection. But remember to only allow the connection for trusted hosts, or, if is a database that is only used by localhost, bind it to 127.0.0.1.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.