I work on a very common case. I configured two servers: an OpenVPN and a MySQL (172.16.X.X) server hidden behind it. Let’s assume everything is perfectly configured and patched server side.
- MySQL server has no public network interface
- MySQL has no TLS configured. It does not use PAM authentication via PAM plugin. It accepts authentications from anywhere.
- It uses a NAT to access the internet (NAT is done by OpenVPN server).
- OpenVPN pushes its routes (172.16.X.X) allowing connected clients to find the MySQL server.
On the client side (192.168.X.X), I have several users who will connect to MySQL server through the VPN, using their own local OpenVPN client. With the previous assumption, unless I’m a fool (which is a possibility, you tell me), no MITM attacker would be able to get the MySQL password.
- Clients have no pre-configured route for the distant VPN network (172.16.X.X).
Let’s imagine: as a user, I try to connect this MySQL “hidden” server and it fails, because ooops… my openVPN software failed to start the tunnel without notice.
Now a malicious machine can be somewhere in the local network - people uses laptops anywhere these days - sniffing my miserable attempt to connect to a non-existing MySQL (172.16.X.X) server.
Will any MySQL client software send cleartext credentials to the default route, even if no MySQL server is found?
Is it possible for an attacker who knows the genuine MySQL server (172.16.X.X) exists to impersonate it by setting up a rogue MySQL server on the local network (192.168.X.X)?
If yes, how can I mitigate this scenario (hint: with a few resources, I work for a very small company)?
Thank you for your help!