Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm hoping to run a mysql server that would be accessed by 2 servers (one on linode, and one on amazon). So far we've just had the mysql server hosted on the linode box locally - so we haven't had to deal with security issues with opening db ports, etc.

I'm hoping to access the mysql server from an amazon ec2 instance - is sharing by ip, port, username and password secure enough for a standard web app? Is there anything else I need to be concerned about?

Thanks!

share|improve this question
add comment

3 Answers

up vote 3 down vote accepted

Aside from the obvious horrible performance you'll experience by accessing this DB server over the internet, there's no reason this can't be done in a secure fashion.

Here are a few things to keep in mind:

  • Throw in an iptables rule to only allow traffic to your mysql port from the IP address of your EC2 instance.
  • Create your mysql grants for only the IP address of your EC2 instance
  • Set up SSL within mysql and require SSL/TLS in your grant statements (if you don't set up SSL, your data will be traversing the internet in cleartext)
share|improve this answer
    
Thank you! Your answer is quite helpful! –  stringo0 Aug 4 '11 at 13:34
add comment

For the most part, yes. Depending upon how sensitive the data is though, it might be worth setting up SSL on your mysql box to encrypt data in transit: http://dev.mysql.com/doc/refman/5.0/en/secure-using-ssl.html

share|improve this answer
add comment

Generally I prefer to firewall at the server level rather than rely on the DB to provide security - that way the MySQL service itself is only exposed to trusted IPs.

By having both the server itself firewalled as well as limiting the MySQL user's privileges by IP, you should be well protected.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.