1

I was wondering if someone could tell me if there is any potential security breeches that could occur by connecting to a sql database that does not reside at 'localhost' i.e. via ip address?

1
  • Problem 1: Credentials are sent in clear text. Apr 15, 2010 at 0:47

4 Answers 4

1

Any data contained in your database could be compromised, as well as potentially even the system if a security vulnerability of that type was discovered in MySQL.

It's generally best not to leave your database accessible on a publicly routable IP. If unable to segregate on a private network it would be advised to at least prevent access by firewalling on the local system.

If you filter access, properly manage the access, and upgrade regularly you will be able to minimize the risk.

1

There are 2 security concerns that are similar to any network application.

  1. Password - is your password hard to guess?
  2. Network sniffing - is the network secure between your computer and the MySQL server? If not then the data may be sniffed. (If you are using a recent version of MySQL the password is encrypted but the data is not.) If this is a concern, you can consider SSL.
0

I wasn't sure if you meant: A - Could your computer be attacked by connecting to a remote SQL database B - Is it a good security practice to have a SQL database listening to an IP address

In the case of A, if you are connecting to a SQL database with a vulnerable client, then yes, you could be attacked.

In the case of B, there are many potential security breaches that could occur via connection to a remote SQL database.

0

Yes, breaches do occur by not protecting the connection to your database. This is a network secuirty question more so than an Application secuirty question. Thus this answer is entirely dependent on your network topography.

If a segment of your network maybe accessible by an attacker, then you must protect yourself with cryptography. For instance you have a malicious individual who has compromised a machine on your network, then they can conduct an ARP Spoofing attack to "Sniff" or even MITM devices on a switched network. This could be used to see all data that flows in and out of your database, or modify the database's response to a specific query (like a login!). If the network connection to your database is a single rj45 twisted connection to your httpd server all residing inside a locked cabinet, then you don't have to worry about a hacker sniffing this. But if your httpd is on a wifi network and then connecting to a database in China, then you might want to think about encryption.

You should connect to your MySQL database using MySQL's built-in SSL ability. This insures that all data transferred is highly protected. You should create self-signed x509 certificates and hard code them. This is free, and you don't need a CA like Verisign for this. If there is a certificate exception then there is a MITM and thus this stops you from spilling the password.

Another option is a VPN, and this is better suited if you have multiple daemons that require secure point to point connections.

You must log in to answer this question.