Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an mysql client with a fixed IP that should be able to access a mysql server. The mysql client is integrated in a software and only port, ip, username and password are modifiable.

What would be the best practice to secure a mysql server without changing the mysql client.

EDIT: No changes to the client side are possible besides the port, ip, username and password.

Currently I have this:


# bind to all ip's
bind to

Restricted the connections for port 3306 to an IP

iptables -I INPUT -i eth0 -p tcp --dport 3306 --src xxx.x.x.xx -j ACCEPT

Drop all traffic to that port that is not allowed

#iptables -I INPUT -i eth0 -p tcp --dport 3306 -j DROP
share|improve this question

Best practice isn't actually answerable, as this depends on a lot of factors.

However, in most cases I would prefer to use an VPN or SSH tunnel to reach the server and not to expose the MySQL server at all, even via SSL and limited to the client's IP address.

share|improve this answer
Sure best practice is not easy answerable. Considered that ssh or vpn tunnels are not possible, what would be the best way to secure anyways. – pauel Apr 19 '13 at 16:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.