Shared MySQL Database Security

Question

I'm hoping to run a mysql server that would be accessed by 2 servers (one on linode, and one on amazon). So far we've just had the mysql server hosted on the linode box locally - so we haven't had to deal with security issues with opening db ports, etc.

I'm hoping to access the mysql server from an amazon ec2 instance - is sharing by ip, port, username and password secure enough for a standard web app? Is there anything else I need to be concerned about?

Thanks!

Answer 1

Aside from the obvious horrible performance you'll experience by accessing this DB server over the internet, there's no reason this can't be done in a secure fashion.

Here are a few things to keep in mind:

• Throw in an iptables rule to only allow traffic to your mysql port from the IP address of your EC2 instance.
• Create your mysql grants for only the IP address of your EC2 instance
• Set up SSL within mysql and require SSL/TLS in your grant statements (if you don't set up SSL, your data will be traversing the internet in cleartext)

Answer 2

For the most part, yes. Depending upon how sensitive the data is though, it might be worth setting up SSL on your mysql box to encrypt data in transit: http://dev.mysql.com/doc/refman/5.0/en/secure-using-ssl.html

Answer 3

Generally I prefer to firewall at the server level rather than rely on the DB to provide security - that way the MySQL service itself is only exposed to trusted IPs.

By having both the server itself firewalled as well as limiting the MySQL user's privileges by IP, you should be well protected.