19

The consensus on this Server Fault question seems to be that opening port 3306 for MySQL is more dangerous than using an SSH tunnel to access MySQL.

I would think that with strong credentials you could keep MySQL safe, especially since the login can be locked down to certain hosts in the USERS table.

Is there something about a MySQL connection that is more insecure than SSH, or is there a risk that connections attempts attacking 3306 could somehow overwhelm the database?

Improve this question
2
  • 4
    MySQL's manual explains that MySQL must not be reachable by untrusted hosts. Before MySQL 4.1, it was sufficient to send the password hash to connect - a Security 101 mistake. However, the post-4.1 authentication protocol seems to at least be a challenge-response protocol, as discussed here.
    – Blaisorblade
    Aug 12, 2015 at 14:39
  • @Blaisorblade Thank you sooo much for the manual and the StackOverflow link. It provides enough details that I want to know. Your comment is more helpful than tens of links and posts I've searched and read. Thank you sincerely and I follow you on Twitter :P . 🤝
    – Rick
    Aug 2, 2022 at 10:22

2 Answers 2

Reset to default
19

If it's not needed, it should be closed.

Vulnerabilities

You can never be sure if there are no vulnerabilities in MySQL itself. Here is an example for a DOS attack (and it's not the only possible attack).

Allowing non-ip restricted remote access to MySQL

Allowing remote access to MySQL is not a vulnerability by itself, but there are scenarios where it can be used in combination with other vulnerabilities.

For example, lets say the site exposes a config file: Anybody could read the database connection credentials. If an attacker can also connect to the database remotely, some or all data is compromised (and other attacks might be possible as well, for example code execution if into outfile is allowed). But if remote connection is not possible, the attacker can do very little with this information (assuming the password is not used somewhere else - eg ssh - as well).

The exposed config file is only an example. For another example consider blind sql injection: retrieving the database password is relatively quick, but retrieving the entire database would take a whole lot of requests. So being able to connect remotely to it would be quite useful.

Allowing ip restricted remote access to MySQL

(This is just speculation) It seems that you can connect to MySQL using udp, so ip spoofing is possible. I could imagine that any attack not needing direct feedback (as for example writing code into a file via into outfile) might work this way (providing that the database credentials are acquired).

Encryption

It should also be considered that ssh is encrypted by default, while MySQL is not (and the setup doesn't seem all too easy). This means that most users will use an insecure connection if direct access to MySQL is provided.

Improve this answer
1
  • It seems that even these days, setting up encrypted MySQL/MariaDB connections is far from trivial. When I looked into it not all that long ago, quite a number of people in various places on the Web recommended just tunnelling the traffic through SSH instead...
    – user
    Sep 1, 2018 at 15:25
0

Just opening the port isn't intrinsically any more dangerous that opening a SSH port.

The problem is that any application program that could USE the port could be hacked, and then be used to compromise your database. Anything running on the client side is inherently not to be trusted.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .