Is blocking all traffic to MySql port, EXCEPT from own server IP, a good security measure?

Question

As the title says, would this help?

Imagine a classifieds website, where users simply login, logout, post classifieds, delete classifieds etc...

All with PHP and mysql.

I have my own server, with IPtables.

Should I block all traffic except from my own servers IP to the MySql port?

Thanks

Answer 1

If you only need access to the mysql from the local server why even start networking at all? The skip-networking option will disable IP communication and everything must use socket based communication.

You could also set bind-address = 127.0.0.1 making it impossible for anything to access mysql except from the localhost.

As for your question, it is usually a very good idea to try to minimize who can access important services.

Answer 2

Yes it's a good idea, but it is important to remember it is just one layer of security - it doesn't protect against other exploits like SQL injection

Answer 3

We close port 3306 entirely and use MySQL GUI's that support either SSL connections or SSH tunneling.

Answer 4

Yes, it's standard security procedure to lock down a database server/daemon so only the computers that need to access it can access it. This is less about programming and more about sys-admin and general network security.

Answer 5

Don't forget to check it first - if you're connecting on an IP address for the server you are connecting via TCP but your originating IP might not be the external IP (depending on your network configuration, it could be internal) so be careful.

If you're connecting on localhost, you can block port 3306 altogether as it's using a socket.