Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

i've got ubuntu server acting as my lamp server for my php websites.

mysql server is installed and opened for the localhost port.

i have read about how to tunnel through ssh to my mysql server.

but i havent understood why this is better than opening the mysql server directly for the internet port.

cause in either way, a hacker could brute force the port for passwords. either mysql port (3306) if opened for the public or ssh (22) if using tunneling.

so why is it better to use ssh tunneling for mysql (and many other server applications)?

share|improve this question
add comment

4 Answers

up vote 6 down vote accepted

If you use SSH tunneling, then your SSH and MySQL passwords are both encrypted during communication -- as well as all data that passes through the tunnel. If you're not using an SSH tunnel and you're not using MySQL's SSL support, there is no encrypting and a malicious third party could use packet sniffing or other nefarious means to eavesdrop on your communications.

Also, if you're using SSH tunneling, then you will be alerted if the remote machine's SSH key changes. This will not happen with standard MySQL, meaning an attacker could use IP spoofing or a Man in the Middle attack to disrupt/interfere/eavesdrop on your communications.

For more information, see:

share|improve this answer
2  
"If you're not using an SSH tunnel there is no encrypting" - That's only true if you don't use SSL (dev.mysql.com/doc/refman/5.1/en/secure-using-ssl.html). –  joschi Mar 29 '10 at 14:59
    
Point taken; answer updated –  Josh Mar 29 '10 at 16:43
add comment

Because you can use certificate authentification prior to MySQL auth.

share|improve this answer
1  
That's also possible with MySQL's built in SSL support: dev.mysql.com/doc/refman/5.1/en/grant.html –  joschi Mar 29 '10 at 15:03
add comment

I would not use SSH tunneling for application traffic unless you have a good reason to. If the application runs on the same server as the database, you should probably use the MySQL socket and disable the networking for MySQL. This is especially true if the server runs directly on the Internet.

If you have multiple servers, you can use SSL natively in MySQL to encrypt the traffic in transit.

I suspect you are referring to developers in larger environments using SSH tunneling for client connections. Typically, this would be because firewall access is not granted directly to MySQL but is allowed for SSH, where SSH would enable a work-around without increasing the footprint of MySQL.

MySQL Using SSL for Secure Connections

share|improve this answer
add comment

but i havent understood why this is better than opening the mysql server directly for the internet port. cause in either way, a hacker could brute force the port for passwords

The simple answer is that there's a culture that trusts SSH to do security better than MySQL. A proponent of the SSH approach may argue that MySQL's password exchange protocol has been compromised in the past, so it's better to rely on SSH.

You're right, though. An SSH password can be brute forced almost as easily as a MySQL password can.

Fortunately, SSH supports a number of authentication methods, passwords being just one of them. For internet facing hosts, I have seen sys admins disable password authentication entirely, opting instead for stronger methods, like public key authentication. See RSAAuthentication in sshd_config(5), and also ssh-keygen(1) for more information on public key authentication.

Hope this helps!

share|improve this answer
1  
+1 for mentioning SSH keys and other means of authentication -- I should have mentioned those –  Josh Mar 29 '10 at 16:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.