Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Just wondering about best security practices for remote admin of a MySQL db in a production, internet connected server?

Specifically if the website is on the same server then it makes sense to bind the server to 127.0.0.1, but then this would only allow remote admin from the remote server (not really remote), and thus in my case ssh, where i much prefer the GUI that mysql comes with.

What is the best way to use the GUI on a remote server. VPN? ssh tunnel? ssl? is there even a need to in peoples minds? because most of the setup should be done in dev and then cloned over by scripts etc?

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

Or in fact, don't use the GUI at all. MySQL does not come with a GUI (despite your suggestion that it does).

As you won't really be doing anything fancy in production anyway, except possibly running carefully vetted queries, you don't need a GUI.

Any schema migrations etc, should be developed on test systems and then tested before they get anywhere near production - the scripts should really be bug-free before they get to production. That's my take anyway.

If developers really WANT to use a gui to prepare migrations, they can, but ultimately only the CODE can go into your version control system anyway.

share|improve this answer
add comment

Set up a ssh tunnel to port 3306 on the remote server. Then you can run any tool/GUI you'd like as if it was on your local machine.

For security, make sure ssh is securely set up of course, limits on users, disabling login with passwords, change default port (22), limit host permitted to connect (optionally with firewall/iptables). And make sure that the connecting machine is securely locked down as well :-)

For read-only queries, I've set up replication to a secondary server using stunnel, which I access using ssh as above.

share|improve this answer
    
Thanks for a way to do it. I may do this, but i have a feeling that the best answer to this is MarkR's answer which is essentially "dont". I gave you an upvote, but the answer to him. –  Mark Feb 3 '10 at 4:09
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.