2

I have a MySQL and Apache web server (both are installed on the same machine). Users will interact with it by a VB.NET application and the web. The server is accessible by the Internet.

VB.NET application: They fill out the fields, and submit the information to the database. Web: Users can view the information any user submitted. The web page simply displays the database in a table format.

The information is not super critical, it's just stats/benchmarks (especially since anyone in the world is allowed to view it). I ask because this is my first time deploying anything SQL. Is it really necessary to enable SSL?

  • 1
    Do users need to log in? Would it be "really bad" if someone changed the data displayed to end users mid-transmission? Is the SSL only for the connection between Apache and MySQL or between Apache and end users? – schroeder Jun 9 '15 at 3:48
  • No. Any credentials are predefined within the application. Honestly, it'd probably be easier to get a copy of the application and make changes yourself. Anyone can submit information. My worry was the login credentials. Even then, the user can only select and insert on specific tables. I guess even if someone got the credentials inside the application, it wouldn't be that bad. – Tyler Montney Jun 9 '15 at 3:53
  • I guess then I answered my own question, unless someone else thinks it's a good idea. I would have implemented SSL by now, but I can't get it to work. That, and I need to install a cert to the local user's store (which is a bit of a pain). – Tyler Montney Jun 9 '15 at 4:00
  • 1
    Please read my post below. The things that "worries" me is that you state that the credentials are predefined within the application. If you mean the VB application, then these credentials are sent in plain text over the wire unless you use the web application's forms and use transport layer protection (meaning HTTPS) on the web server. – Jeroen - IT Nerdbox Jun 9 '15 at 4:03
4

You basically answered your own question by stating anyone in the world can read this information. This makes me believe it is not necessary.

However, from a security point of view it is always recommended to use best practices, meaning: use transport layer protection.

Web based Clients

Since the web server and database server run on the same machine, connections to the database should be made to 127.0.0.1:3306 as MiTM attacks are not possible. However, privileged (non database) users on the server could capture this traffic

VB Clients

These specific clients will most likely directly connect to your MySQL server. If this is the case, the clients send their credentials over a non secure transport layer.

If the VB Client uses the web forms of the web server, the above statement does not apply and the same applies here as for the web based clients.

Considerations & Recommendations

In case your VB clients directly connect to your database over the internet, it is recommended to use transport layer protection [1].

Consider if you might store more sensitive data in the future. Be prepared for the future.

One day someone might have this "bright idea" by saying: "Let's create an additional form where the users should store their details", where you have to store their names, addresses, e-mail addresses and IP address for example.

[1] I try to avoid using the term SSL due to the somewhat recent flaws.

  • Yeah, you couldn't have said it any better. I feel silly for asking the question, but I supposed talking it out makes me realize the answer. – Tyler Montney Jun 9 '15 at 4:02
  • Yes, the only way they submit to the database is by my VB application. The website is simply to view the data. You cannot edit anything from the website. I figured it was not secure, and it felt silly to expose my credentials (or anything else important) if I didn't have to. I don't want to get embarrassed. In regards to "in the future we may store sensitive information", I was considering it a while ago. Considering the scope of my project, I decided I'm not willing to do that. My first time deploying a SQL server over the Internet, and store sensitive data? Asking for trouble :) – Tyler Montney Jun 9 '15 at 4:03
  • It's good you asked this question, now you know what (not) to do. – Jeroen - IT Nerdbox Jun 9 '15 at 4:06
  • In addition: Consider writing an API that "lives" on the web server and holds the credentials to the database. This will introduce new "challenges" as far as the VB client / someone accessing your API directly but there are solutions to that as well. One that quickly comes to mind is the usage for API keys that are required to be entered in the VB application before it can be used. (By the way, transport layer protection still applies here) – Jeroen - IT Nerdbox Jun 9 '15 at 4:15
  • If someone were able to get a high enough level of access to sniff traffic on localhost, I think you're hosed at that point. Security needs to be balanced with maintainability. Is the additional complexity of encrypting traffic that exists within your own trusted machine really worth it? Generally I'd say not. I'm skeptical of the words "best practices" as they don't specify context, and are too often used to justify un-necessary practices where they don't apply. YMMV. – Steve Sether Jun 9 '15 at 4:31
4

I have a MySQL and Apache web server (both are installed on the same machine). Users will interact with it by a VB.NET application and the web. The server is accessible by the Internet.
...
The information is not super critical, it's just stats/benchmarks (especially since anyone in the world is allowed to view it)

These two statements seem to contradict each other. On one hand, both MySQL and Apache are on the same host, but "anyone in the world is allowed to view it." I'm assuming you're referring to the data output by your web application?

If the first statement is true and both your Apache webserver and your MySQL database server exist on the same machine, there is no benefit to adding SSL, as Raniz mentioned in his answer. However, if they exist on different machines or if you access MySQL remotely, you should enable SSL.

The important thing here is to model what SSL protects you against, which is primarily password-stealing. If you connect to a MySQL server over the internet without using SSL, anyone who is lucky enough to sit between you and your final destination (the MySQL server) can easily extract your username and password for MySQL. They can then do whatever they'd like with the user credentials they've extracted.

You seem unconcerned with this possibiltiy in saying "the information is not super critical," but you likely should be concerned with this possibility. What if an attacker deleted everything from the database? Or subtly injected erroneous data and destroyed your site's credibility? What if they were able to use an exploit in SQL to get a shell on your machine?

If, however, like you say that your MySQL server lives and is accessed only locally (never over WAN), you don't need SSL. If it's public facing or ever shares data over an insecure network, use SSL.


An alternative to using MySQL over SSL is using SSH port forwarding whenever you need to access MySQL remotely.

ssh -L 3306:localhost:3306 myhost.com

This will forward all traffic to the local port 3306 over SSH to the local port 3306 of myhost.com. This secures your credentials while still allowing access.

SSL in general isn't the easiest thing to set up, and MySQL is no exception. Still, if you need services to access MySQL over the network, SSL serves a much-needed purpose.

  • I am unconcerned with the data. I am concerned with the credentials predefined in my application. I've done Least Privilege with all my user accounts, but I still would rather someone didn't know the actual credentials I used. If someone did delete the entire thing, it would be annoying and embarrassing at worst. Trust me, I am at some level concerned because I asked the question. At this rate, I am convinced to continue my effort in getting SSL working. – Tyler Montney Jun 9 '15 at 4:09
  • If your MySQL server is accessible by or uses a non local network, you should probably enable SSL. If MySQL lives locally, only listens on 127.0.0.1:3306, you should be fine. – Naftuli Kay Jun 9 '15 at 4:11
  • It's over the Internet. – Tyler Montney Jun 9 '15 at 4:11
  • If it's accessible over the internet, you should use SSL. This will protect your credentials and prevent eavesdroppers from watching your connection. – Naftuli Kay Jun 9 '15 at 4:12
  • The only thing preventing me from enabling SSL is my own inexperience. I haven't worked with generating certificates or keys. The tutorials I found so far seem to be lacking. (I should note they are very well written but not comprehensive enough for me.) That was another reason why I felt compelled to ask before I went any further. – Tyler Montney Jun 9 '15 at 4:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.