Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a CentOS server running a MySQL server. I would like to prevent remote access to MySQL. How can I achieve this?

share|improve this question
    
It usually is that way by default. –  Zoredache Mar 11 '12 at 19:49
    
Just to note that if it were me I'd set the bind address AND reject external connections with iptables AND set the permissions in the DBMS appropriately. –  symcbean Mar 11 '12 at 23:19

4 Answers 4

up vote 2 down vote accepted

As @Bruno answered, edit my.cnf and set the bind address.

The other way is to set access control at MySQL user level. The Grant syntax shows this. Users accounts can be set to accessible from a particular network IP ( like 127.0.0.1 or localhost or %.%.%.% )

share|improve this answer

Bind its local address to localhost, in the MySQL configuration file:

bind-address            = 127.0.0.1

(or only use unix sockets).

Note that users tunnelling through SSH will be treated as coming from localhost too: don't give out SSH accounts in this case.

share|improve this answer
1  
This file is normally my.cnf, type locate my.cnf. It is normally in /etc/mysql/my.cnf, /etc/my.cnf or similar. –  SimonJGreen Mar 11 '12 at 19:03

If your server is behind NAT ( i.e it has "local" address(es) only but it still receives traffic directly from the internet ) but you have more than one machine on this network ( so binding to 127.0.0.1 is not an option ) then blocking all but local traffic using your firewall will be the way to go.

In iptables, you can accomplish this using these commands as root:

iptables -I INPUT --dport 3306 -j DROP
iptables -I INPUT -s 192.168.0.0/24 --dport 3306 -j ACCEPT

Note that this puts the DROP rule in as the first rule and then puts the ACCEPT rule in before that. There is probably a much better way of doing this using whatever method you use to save your firewall rules. ( Probably iptables-save and iptables-restore.)

share|improve this answer

I wonder is using the built in "--skip-networking" command line parameter would do what you need. As Zoredache mention this appears to be the default.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.