Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to setup a mysql server on my machine. I would like to limit the domains that it listens for connections to. My understanding is that you can either have it listen to 1 ip or all ip's. Therefore, if i want to connect remotely I have to say all ips. Then I would like to block all domains but the ones I know should actually be connecting.. I believe this is done through windows firewall. However, how do i do this by domain instead of IP?

share|improve this question
1  
you can limit the host of each user of mysql. This means you can define from where you can login with this user, isn't that something of what you are looking for? –  Sven Jung Nov 22 '12 at 20:48
    
yes, this i can do. regardless of whether mysql has that limit or not, i want my system to reject connections from all hosts that are invalid –  Alex Nov 22 '12 at 21:38
    
do you want to ban particular ip's only for mysql or for your entire server? –  Sven Jung Nov 23 '12 at 8:00
    
for my entire server. and in particular, i want to allow only certain domains. –  Alex Nov 23 '12 at 18:01
add comment

1 Answer

In mysql users are stored in the form user@host with % as a wildcard, and all non-matching hosts are blocked by default. Usually at install only the root@localhost account is created, and usually without a password.

You can define users in such forms as:

--allow login anywhere
CREATE USER 'user'@'%' IDENTIFIED BY 'password';

--allow from hosts in the mydomain.com domain
CREATE USER 'user'@'%.mydomain.com' IDENTIFIED BY 'password';

--allow from hosts in the 123.123.123.0/24 subnet
CREATE USER 'user'@'123.123.123.%' IDENTIFIED BY 'password';

Bear in mind that if you use the same username for two different networks, ie:

CREATE USER 'user'@'123.123.123.%' IDENTIFIED BY 'password1';
CREATE USER 'user'@'213.213.213.%' IDENTIFIED BY 'password2';

their passwords are managed completely separately.

If you require more granular control than this then you will want to use a firewall.

You can view existing users by running:

USE mysql;
SELECT * FROM users;

Relevant Documentation

share|improve this answer
    
thank you for your response. i have done this already but i would like to make sure that my computer itself is filtering connections as well just to be doubly safe. how do i set this up in windows firewall? –  Alex Nov 22 '12 at 22:44
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.