Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to find documentation that discusses a secure way to create a permanent connection between an Apache Webserver and a separate MySQL database server. I'm not having a lot of luck finding the standard process to connect the two securely. How is this typically done?

share|improve this question
2  
What do you mean by a "permanent connection"? –  Coding Gorilla Sep 27 '11 at 15:03
    
I want to install a web application that uses PHP for the app and mysql for the database across two servers. For the application to function is has to talk to the database so I need a connection between the two. –  JMC Sep 27 '11 at 15:07
    
And the PHP app doesn't have some configuration file that specifies the DB Server?? –  Chris S Sep 27 '11 at 15:11
    
There is a configuration. Actually making it connect isn't the real problem. I'm trying to find the typical process for securing the connection between the two. For example knowing to allow port 80 on the webserver but block port 80 traffic to the database is useful info. I'm sure there's more that I don't know. –  JMC Sep 27 '11 at 15:15
1  
All traffic should be blocked by default on a computer facing the Internet. Then specifically allow only the traffic you need; this has nothing to do with Apache/PHP/MySQL, it's just basic security. Your webserver needs any IP to be able to get to port 80. The DB server needs only the webserver to be able to get to port 3306. Add management ports/IPs as necessary. –  Chris S Sep 27 '11 at 15:20
add comment

2 Answers 2

up vote 2 down vote accepted

Have your servers on a private VLAN(s).

If your Application server is 192.168.1.10 and your MySQL server is 192.168.1.11 -

On the MySQL server do a GRANT statement that gives your PHP application's host access to the MySQL server. i.e. GRANT INSERT, SELECT on db.* from appuser@'192.168.1.10' identified by 'password';

In your PHP code specify the MySQL host when you create the connection string:

$link = mysql_connect('192.168.1.11:3306', 'appuser', 'password');

Also need to ensure that your my.cnf doesn't have bind-address=127.0.0.1, if it does no remote connections will be permitted. So comment that out.

share|improve this answer
    
Is there a way to use bind-address with the webserver's ip for security or does that option do something else entirely? –  JMC Sep 27 '11 at 15:33
    
@JMC, The MySQL GRANT statement does that. i.e. from appuser@'192.168.1.10' The MySQL bind-address option binds MySQL to a particular network interface. –  HTTP500 Sep 27 '11 at 16:04
add comment

There is no such thing as a "permanent connection" between the web application and the DB Server. The application will open a connection to the SQL server, do its work, and then close the connection when it's done.

The way in which the application connects to the server is determined by the application itself; typically it will have a configuration file in which you will need to set the connection parameters. And what options you have for securing that connection are going to be in part determined by what that application supports and requires.

share|improve this answer
    
Not always true. PHP provides "persistent" connections that are not closed when the script terminates. Other platforms provide connections pools that are kept open and reused. –  Craig Sep 27 '11 at 16:33
    
@Craig I understand that, my take on what he was asking for was like a "dedicated pipe" so that's sort of where I went. But then I also added that the options he had were going to be determined by the what the application provided. He never specified whether he was working with PHP, Java, or something else so I couldn't be more specific in that regard. –  Coding Gorilla Sep 27 '11 at 16:42
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.