Secure method to access a MySQL DB over the internet?

Mr.Guvernment · Apr 22, 2008

Need some advice

setting up a MySQL DB on a server, it will need to allow access over the internet to it from another office.

what is the most secure way this can be done?

Obvious:

IP filter on the user account on the MySQL Db
Ip filter list on the firewall for the port

change the port to something other then the standard MySQL port?

SSH or SSL if possible?

=ACID RAIN= · Apr 22, 2008

VPN

Maybe you can tunnel it through SSH, not sure.

edit: yeah you can tunnel it through SSH, but not sure what client and server to use.

ziggo0 · Apr 22, 2008

I used to use SSH...just like being there, but not.

Mr.Guvernment · Apr 22, 2008

i dont want them to have direct access to the server, only a conneciton to the database, they are not getting any remote access, so no vpn or anything.

SSH i will look into, just want it to be as secure as possible!

=ACID RAIN= · Apr 22, 2008

VPN would be the same as SSH, just VPN the port (normally 3306 for mysql db) and firewall the rest.

But I do think SSH would be better. Just open a high-level port for the SSH tunnel and forward 3306 or whatever to it.

Mr.Guvernment · Apr 22, 2008

oh VPN, DOH i was thinking VNC..lol been a long dayyyyyyyyyyyy

=ACID RAIN= · Apr 22, 2008

LMAO sounds like it. Have a beer when you get home LOL

skidooosl · Apr 22, 2008

what type of router / firewall is at each office? you could just do a site to site VPN between the 2 firewalls and the connection would be completely transparent to the user.... rather than have them each use putty or what not.

Mr.Guvernment · Apr 22, 2008

at their office not sure since it isnt our office, our end we have a netgear right now, have a firebox that broke down so working on fixing it.

how would i limit the VPN access though to only the mysql DB and nothing else? so they dont use the internet connection of the host?

dark_15 · Apr 22, 2008

If you don't want to use a VPN, you can encrypt the database connection. Take a look at the MySQL reference guide HERE to make a self-signed cert and use that to encrypt the connection.

=ACID RAIN= · Apr 22, 2008

dark_15 said:
If you don't want to use a VPN, you can encrypt the database connection. Take a look at the MySQL reference guide HERE to make a self-signed cert and use that to encrypt the connection.

Hadn't thought of that. Hell I didn't even know mysql had encryption, but now that I think about it, that makes sense. Man, open source is awesome.

dark_15 · Apr 22, 2008

=ACID RAIN= said:
Hadn't thought of that. Hell I didn't even know mysql had encryption, but now that I think about it, that makes sense. Man, open source is awesome.

MSSQL can do it as well, and the method for MySQL I mentioned is pretty similar to MSSQL's method. I've used it before as a quick and dirty way of getting things going.

Now a VPN would accomplish the same requirement, but terminating a VPN on a Netgear... well, it's not very fun and painful to troubleshoot at times.

Mr.Guvernment · Apr 23, 2008

thank you dark, shall read up on that link at work tomorrow

skidooosl · Apr 23, 2008

if you create a site to site VPN (although I doubt the netgear will allow you to) you can restrict access with firewalls rules.... basically just have a rule with the source network or IP's which require access and have the destination be the IP of the server and only allow the ports you will be using.

you will have to get with the remote admin to see if they can set that up and you would also have to see if you can create a VPN on your side

Mr.Guvernment · Apr 23, 2008

i know i could do a VPN on our watchguard box, i will keep that option in mind if the ncrypted mysql fails for me

Secure method to access a MySQL DB over the internet?

Mr.Guvernment

Member

=ACID RAIN=

Member

ziggo0

Member

Mr.Guvernment

Member

=ACID RAIN=

Member

Mr.Guvernment

Member

=ACID RAIN=

Member

skidooosl

Member

Mr.Guvernment

Member

dark_15

Drunken Master JNCIE Senior

=ACID RAIN=

Member

dark_15

Drunken Master JNCIE Senior

Mr.Guvernment

Member

skidooosl

Member

Mr.Guvernment

Member

Similar threads