Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm reviewing the security groups on my EC2 Ubuntu instance that runs a public website on LAMP. Presently my ports are as follows:

22 (SSH)
80 (HTTP)
443 (HTTPS)
3306 (MYSQL)

I'm thinking it should be possible to tighten up a bit on the mysql port as the connections are only made locally. Any insights are welcome.

share|improve this question
up vote 3 down vote accepted

If your MySQL instance is running on the same instance and is only answering local connections, then you don't need any entries for port 3306 at all in your security group config.

Also, for defence in depth, you should set the bind-address MySQL configuration directive to (probably the default, but worth checking).


You've two routes for opening up access from outside:

  • Set bind-address back to, and add a.b.c.d/32 to your security group (whatever that IP might be) to allow access on port 3306. However, this is a basic method that transmits in plaintext.
  • Use SSH port forwarding. Logging in to your shell with ssh -L33306: user@host will let you then launch mysql -h localhost -P 33306 on your local machine to connect through the tunnel. -bind-address doesn't need to be opened up in this case, since the mysql connection is still local (the local port can be whatever you like so long as the -L and -P arguments match) . This will give you a more secure route in, and you can configure SSH to use private keys, for added protection.
share|improve this answer
SmallClanger, thanks for the info. That's what I was looking for. Now, what if I wanted to open up mysql to a known external IP. I assume that would be entered in the AWS ports settings. But what about the bind-address directive? – Swaylock Mar 7 '12 at 20:30
Added in some more to my answer. – SmallClanger Mar 7 '12 at 21:40

Hardening is very important.

  1. For MySQL, set the source, same as the security group. ( Eg: If the security group "default" has id "sg-1234s3gd", specify sg-1234s3gd as source for portrange 3306 ).
  2. Install mod_security for Apache and subscribe to CoreRulesSet. If possible Rate Limit the requests per IP.
  3. Disable RootLogin in SSH. Allow only key based authentication, Change SSH listen port if possible.
  4. Run a security assessment using Bastille.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.