Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

As the title says, would this help?

Imagine a classifieds website, where users simply login, logout, post classifieds, delete classifieds etc...

All with PHP and mysql.

I have my own server, with IPtables.

Should I block all traffic except from my own servers IP to the MySql port?

Thanks

share|improve this question

migrated from stackoverflow.com Nov 13 '10 at 0:46

This question came from our site for professional and enthusiast programmers.

    
Wouldn't phpMyAdmin still need that port for it's connection(s)? –  OMG Ponies Nov 13 '10 at 0:40
1  
@OMG Ponies - I would think he would run the phpMyAdmin on the LAN –  Matt Nov 13 '10 at 0:42
    
@Matt: phpMyAdmin is a webapp; dunno if IPTables provides application layer filtering... –  OMG Ponies Nov 13 '10 at 0:45
1  
@OMG Ponies: no, iptables doesn't provide applicationlayer filtering. It depends where the phpMyAdmin installation is. If it is on the same host there won't be a problem. –  Zoran Zaric Nov 13 '10 at 1:11

5 Answers 5

up vote 8 down vote accepted

If you only need access to the mysql from the local server why even start networking at all? The skip-networking option will disable IP communication and everything must use socket based communication.

You could also set bind-address = 127.0.0.1 making it impossible for anything to access mysql except from the localhost.

As for your question, it is usually a very good idea to try to minimize who can access important services.

share|improve this answer

Yes, it's standard security procedure to lock down a database server/daemon so only the computers that need to access it can access it. This is less about programming and more about sys-admin and general network security.

share|improve this answer

Yes it's a good idea, but it is important to remember it is just one layer of security - it doesn't protect against other exploits like SQL injection

share|improve this answer

We close port 3306 entirely and use MySQL GUI's that support either SSL connections or SSH tunneling.

share|improve this answer

Don't forget to check it first - if you're connecting on an IP address for the server you are connecting via TCP but your originating IP might not be the external IP (depending on your network configuration, it could be internal) so be careful.

If you're connecting on localhost, you can block port 3306 altogether as it's using a socket.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.