Our site is going live soon and I am thinking about security. We have a typical layout of nginx, apache and mysql at back. Ideally the only machines exposed to the net would be the nginx servers but during development we have been using phpmyadmin installed locally on dev machines and then using Putty to SSH tunnel to the backend mysql machines. That means the myslq machines need to be exposed to the net on at least port 22.
So the question is, is it better to restrict IP access to mysql linux instances to the web servers and install phpmyadmin on one of the web servers. I have heard that phpmyadmin is not secure so it is best kept off production machines, hence dev env having it installed on dev machines.
I suppose if we keep on running it locally and use Putty then we only need to expose port 22 to the net. Is that a lesser risk?