Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have 2 Servers - one for PHP, and one for MySQL

Both servers are hardened - and now my question is, what's the correct way to set up a connection to the Database Server, from PHP? Probably over SSH? Or is just the open MySQL port enough?

But if it's only over the open Port, how can I ensure that no bruteforce attacks try to get the root password, over that open Port? Can I somehow limit the IP access to the webserver? (if yes, how?)

Basically, I'm just asking what's the common / best way to set up / configure this kind of connection.


further analysis

I added iptables entries, added ufw entries (that basically generated the same iptable entries), etc, etc - sadly, nothing seems to work. My try to connect to mysql from the webserver, always gets blocked (I installed the mysql-client on the webserver, testing with the mysql commant - result: / xxx for obfuscation)

ERROR 2003 (HY000): Can't connect to MySQL server on 'xxxx' (111)

I added LOG entries for iptables, and checked the ufw log, and syslog - but apparently, the package doesnt get blocked (no [UFW BLOCK]). After searching a bit more, I guessed it could have been apparmor - but after installing auditd there are no visible blocks for mysql.

netstat shows mysql listening, on the correct port.

How can I analyze the issue further? What could be the reason for the blocking?


Solution found

Ironically, I found the answer 1 minute after the edit:

what was missing was a change in the mysql configuration file, namely bind-address had to be changed to the external IP.

The port protection works

share|improve this question

1 Answer 1

up vote 4 down vote accepted

You say that you server is hardened so you should be some way to reducing the risk already but check a few things.

  • Ensure that your OS firewall only allows connections to MySQL from the php server. For a Linux server you could use iptables to do this

    iptables -A INPUT -p tcp -s php.server.address --dport 3306 -j ACCEPT iptables -A INPUT -p tcp --dport 3306 -j DROP

  • Ensure that the MySQL root user can only connect from the database server itself.

  • Ensure that your databse users can only connect from your php server and that they only have sufficient privilege to do what's necessary.

    GRANT SELECT, INSERT ON mydb.* TO 'someuser'@'php.server';


As Lucas suggests you could add SSL to the connection - the MySQL manuals for this is here.

share|improve this answer
1  
I would also recommend to make sure he has SSL enabled –  Lucas Kauffman Jan 26 '13 at 9:45
    
I tried your approach, and at first, it looked promising - but I still cant get the connections to work. I temporarily disabled ufw on both servers (php and DB server) - still, I couldnt even telnet on the mysql port (not even on port 80, but on the SSH port) - what could I do? –  Katai Jan 31 '13 at 20:03
    
@Katai: I thought you wanted to know how to tighten up security on an existing system ? –  Iain Jan 31 '13 at 21:43
    
@Iain: Of course, I just deactivated ufw to test if it's because of the firewall or not - the security apparently isnt the problem, since I cant access the DB ;) (not even with the iptables entry). My problem is to find out where my Webserver gets blocked now (and I'm a bit too unexperienced as serveradmin to really know how to trace that back, I tried telnet to test the port, the only port working with telnet is the SSH port. I couldnt even access port 80) –  Katai Feb 1 '13 at 7:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.