0

I have an mysql client with a fixed IP that should be able to access a mysql server. The mysql client is integrated in a software and only port, ip, username and password are modifiable.

What would be the best practice to secure a mysql server without changing the mysql client.

EDIT: No changes to the client side are possible besides the port, ip, username and password.

Currently I have this:

/etc/mysql/my.cnf

# bind to all ip's
bind to 0.0.0.0

Restricted the connections for port 3306 to an IP

iptables -I INPUT -i eth0 -p tcp --dport 3306 --src xxx.x.x.xx -j ACCEPT

Drop all traffic to that port that is not allowed

#iptables -I INPUT -i eth0 -p tcp --dport 3306 -j DROP
1

1 Answer 1

0

Best practice isn't actually answerable, as this depends on a lot of factors.

However, in most cases I would prefer to use an VPN or SSH tunnel to reach the server and not to expose the MySQL server at all, even via SSL and limited to the client's IP address.

1
  • Sure best practice is not easy answerable. Considered that ssh or vpn tunnels are not possible, what would be the best way to secure anyways.
    – pauel
    Apr 19, 2013 at 16:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .