0

I'm reviewing the security groups on my EC2 Ubuntu instance that runs a public website on LAMP. Presently my ports are as follows:

22 (SSH)    0.0.0.0/0
80 (HTTP)   0.0.0.0/0
443 (HTTPS) 0.0.0.0/0
3306 (MYSQL)    0.0.0.0/0

I'm thinking it should be possible to tighten up a bit on the mysql port as the connections are only made locally. Any insights are welcome.

Improve this question

2 Answers 2

Reset to default
3

If your MySQL instance is running on the same instance and is only answering local connections, then you don't need any entries for port 3306 at all in your security group config.

Also, for defence in depth, you should set the bind-address MySQL configuration directive to 127.0.0.1 (probably the default, but worth checking).

EDIT

You've two routes for opening up access from outside:

  • Set bind-address back to 0.0.0.0, and add a.b.c.d/32 to your security group (whatever that IP might be) to allow access on port 3306. However, this is a basic method that transmits in plaintext.
  • Use SSH port forwarding. Logging in to your shell with ssh -L33306:127.0.0.1:3306 user@host will let you then launch mysql -h localhost -P 33306 on your local machine to connect through the tunnel. -bind-address doesn't need to be opened up in this case, since the mysql connection is still local (the local port can be whatever you like so long as the -L and -P arguments match) . This will give you a more secure route in, and you can configure SSH to use private keys, for added protection.
Improve this answer
2
  • SmallClanger, thanks for the info. That's what I was looking for. Now, what if I wanted to open up mysql to a known external IP. I assume that would be entered in the AWS ports settings. But what about the bind-address directive?
    – Swaylock
    Mar 7, 2012 at 20:30
  • Added in some more to my answer.
    – SmallClanger
    Mar 7, 2012 at 21:40
0

Hardening is very important.

  1. For MySQL, set the source, same as the security group. ( Eg: If the security group "default" has id "sg-1234s3gd", specify sg-1234s3gd as source for portrange 3306 ).
  2. Install mod_security for Apache and subscribe to CoreRulesSet. If possible Rate Limit the requests per IP.
  3. Disable RootLogin in SSH. Allow only key based authentication, Change SSH listen port if possible.
  4. Run a security assessment using Bastille.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .