Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have my app (a PHP forum) and database on separate servers, and want to make sure that the connection between them is secure. I've taken all the preliminary steps that I've come to know of, and am wondering if I should secure the connection through SSH Tunneling or OpenVPN.

The problem is that, I am told, SSH Tunnel and OpenVPN can hog performance, especially when the app is write heavy (i.e. lots of data is constantly transferred to and from the database).

What I would like to know is, in the real world, do people connect app and database servers using SSH or OpenVPN, or do they consider it unnecessary, or are there any alternatives?

EDIT (1): The app and database servers are connected via the private network provided by my hosting service provider, but I hear that for anyone else (think a hacker) on the private network (i.e. other customers like me) it's just like a public IP address.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

If the servers are on the same LAN (or in an EC2 VPC, etc.) then no, I do not encrypt data between them. However, if traffic traverses the open internet (e.g. with "legacy" non-VPC EC2 servers), then it's a great idea to encrypt.

That said, I'd not choose either OpenVPN nor SSH tunnels for this. Rather, consider IPSec, most likely in transport mode. This will encrypt packet contents, but leave IP headers in place so that you don't need to muck around with routing.

I recommend IPSec over the other components due to the fact that once configured, it tends to be much more stable than the other two options, and requires less "fiddling" in the long run.

share|improve this answer
    
You said, "If the servers are on the same LAN..." Did you mean if they are connected via a private network? Please see my question, I've just updated it. –  its_me Sep 13 '13 at 3:26
    
I use IPSec in transport mode quite a bit for exactly this sort of thing. –  Michael Hampton Sep 13 '13 at 3:26
    
@MichaelHampton So, considering the basic steps that I've taken (dba.stackexchange.com/q/49716/4764) it should be good to go with IPSec, right? –  its_me Sep 13 '13 at 3:27
    
@its_me We can provide our experience and recommendations, but you still have to think about them. :) –  Michael Hampton Sep 13 '13 at 3:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.