3

I have gotten my personal vServer with a standard installation of Ubuntu Server 16.04 and I wanted to install and configure a MySQL server on it. I was considering to disable direct external access, but enable tunnelling so that I can create a secure tunnel using SSH to access it from my computer anyways.

Considering this I would like to know whether there are any caveats of the attempt to secure this.

3

Well, assuming you are using SSH to access the server anyway, that tunneling is effectively already in place. I would suggest doing a few things to prevent unauthorized access to your VPS:

  1. Give a non-privileged user "sudo" access. Make sure you do this first if you decide to also implement step 2. Otherwise, you'll lose remote access to your server.
  2. Prevent Root Login over SSH. Now you'll only be able to login remotely as the unprivileged user in step 1.
  3. Change the port SSH listens to. I personally use a port number over 10000 that ends with "22". This helps avoid drive-by hacking attempts that hit the standard SSH port (22).

The combination of these three changes will mean that you will need to login as an unprivileged user first, using the custom port you chose in step 3. Then you can issue privileged commands using the sudo command. You'll also need to use the custom port and unprivileged user for SSH tunneling of your MySQL client.

0

I was considering to disable direct external access

good choice.

enable tunnelling so that I can create a secure tunnel using SSH to access it from my computer anyways.

SSH is Secure Shell. If you tunnel the connection using ssh, it is secure as far as both ends are secure. The connection is not breakable these days. There is no need to secure it further. If you are able to log in, you are able to "tunnel" and unless anybody else is able to log in to your ssh, they are not able to do anything with your mysql (in that case, you should be able to worry about other stuff than just mysql).

  • "There is no need to secure it further." This is true of mysql in this scenario, but not true of SSH. There are additional changes that are recommended for SSH that I've outlined in my reply to the OP. – Jason Huebel Dec 5 '16 at 14:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.