Is there a point to set up passwords for services like MySQL, Redis etc. if we disable their related ports?

Question

Redis' default port is 6379 and MySQL's default port is 3306. Let's say we disable these ports to outside of the world with ufw. And let's say only I have access to the servers. Is there still a point to set up passwords for services like that? Personally I can't see any. Thanks!

Answer 1

Security is all about defense in depth. Most breaches happen not because someone left a door open, but because a number of small vulnerabilities can stack up to make an unexpected and much larger problem. What if you accidentally make a mistake in your firewall configuration? What if someone gains physical access to your network? There are a lot of "what-ifs" that can happen that can make your assumption - "no one else is on my network" very questionable.

I can't find the article at the minute but I remember reading about some ATM attacks that allowed hackers to withdraw hundreds of thousands of dollars from ATMs in southeast Asia. The attacks started with the attackers hacking into the London offices of the bank, and from there to move laterally through the network and eventually access the ATMs in southeast Asia due to lack internal Network security on the part of the bank. Better security In just one more place might have stopped the whole thing, but the bank assumed that they only had to worry about external security.

The point here should be obvious. If you only have one line of defense you are fine up until that line of defense is breached. With multiple layers of defense you improve the odds that even if there is a sscurity failure in one place your systems may stay secure.

Of course, security is not an absolute concept. Perhaps there is not anything of any real value in your MySQL server. Perhaps you have regular and reliable backups in place so that even if a hacker maliciously drops your data just because they can, you can be back up and running in no time. Maybe this is just a personal project so there is nothing at stake anyway. I don't know what your systems do, and if it is nothing important and you are willing to risk intrusion to make managing your systems easier, then that is certainly a choice e you can make.

Answer 2

To add up on Conor previous answer, even if the mysql port isn't open, it might be vulnerable at some point as a privilege escalation vector. Meaning that if an attacker has found a way into your system, he might use a known (or zero day) vulnerability to compromised your mysql server potentially leading to a privilege escalation (i.e gaining root).

There are a lot of exploit/PoC available publicly that are exploiting MySQL or other SQL/NoSQL servers..