Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an mysql client with a fixed IP that should be able to access a mysql server. The mysql client is integrated in a software and only port, ip, username and password are modifiable.

What would be the best practice to secure a mysql server without changing the mysql client.

EDIT: No changes to the client side are possible besides the port, ip, username and password.

Currently I have this:

/etc/mysql/my.cnf

# bind to all ip's
bind to 0.0.0.0

Restricted the connections for port 3306 to an IP

iptables -I INPUT -i eth0 -p tcp --dport 3306 --src xxx.x.x.xx -j ACCEPT

Drop all traffic to that port that is not allowed

#iptables -I INPUT -i eth0 -p tcp --dport 3306 -j DROP
share|improve this question
1  

1 Answer 1

Best practice isn't actually answerable, as this depends on a lot of factors.

However, in most cases I would prefer to use an VPN or SSH tunnel to reach the server and not to expose the MySQL server at all, even via SSL and limited to the client's IP address.

share|improve this answer
    
Sure best practice is not easy answerable. Considered that ssh or vpn tunnels are not possible, what would be the best way to secure anyways. –  pauel Apr 19 '13 at 16:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.