I have 2 Servers - one for PHP, and one for MySQL
Both servers are hardened - and now my question is, what's the correct way to set up a connection to the Database Server, from PHP? Probably over SSH? Or is just the open MySQL port enough?
But if it's only over the open Port, how can I ensure that no bruteforce attacks try to get the root password, over that open Port? Can I somehow limit the IP access to the webserver? (if yes, how?)
Basically, I'm just asking what's the common / best way to set up / configure this kind of connection.
I added iptables entries, added ufw entries (that basically generated the same iptable entries), etc, etc - sadly, nothing seems to work. My try to connect to mysql from the webserver, always gets blocked (I installed the
mysql-client on the webserver, testing with the
mysql commant - result: /
xxx for obfuscation)
ERROR 2003 (HY000): Can't connect to MySQL server on 'xxxx' (111)
LOG entries for iptables, and checked the
ufw log, and
syslog - but apparently, the package doesnt get blocked (no [UFW BLOCK]).
After searching a bit more, I guessed it could have been
apparmor - but after installing
auditd there are no visible blocks for
netstat shows mysql listening, on the correct port.
How can I analyze the issue further? What could be the reason for the blocking?
Ironically, I found the answer 1 minute after the edit:
what was missing was a change in the mysql configuration file, namely
bind-address had to be changed to the external IP.
The port protection works