Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have mysql database hosted on Amazon EC2 server and i want to access it remotely to make changes to it. As i dont have static IP, i cannot allow specific IP in firewall for secure access to port 3306.

Is there any other way to open 3306 securely from remote machine? one solution can be tunneling port 3306 through ssh, so any other Secure access solution we have to access 3306?

Thanks

share|improve this question
add comment

3 Answers 3

up vote 2 down vote accepted

SSH tunneling is likely the easiest option to get set up as it doesn't require changes to your MySQL configuration. It is just as secure as using MySQL's built in SSL support.

From your workstation, just run:

$ ssh user@host -L3306:localhost:3306

Then connect connect to localhost:3306 and you'll be all set. You'll likely need to add a grant for whatever user you will be connecting with.

share|improve this answer
add comment

You may find the MySQL SSL documentation useful:

http://dev.mysql.com/doc/refman/5.0/en/secure-connections.html

In your case I'd recommend using at least server-side SSL to protect your password and data, but using a (self-signed and trusted on the server) client SSL certificate might not be a bad idea either.

I don't generally recommend host-based authentication or using a host-based ACL to secure your connection to anything, because IPs (and DNS names, as some people use!) can be spoofed and hijacked, and also you don't need administrative access to the trusted client to compromise it enough, and generally these things are easier to do than compromising a reasonably long private key. Additionally, if you don't use SSL you are vulnerable to traffic sniffing attacks.

share|improve this answer
add comment

If you're talking about Amazon's RDS instances, then you can already have the connections use SSL to connect. If you configure your DB users accordingly you can also make it a requirement.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.