How to setup separate MySQL and PHP VPS servers

Question

Someone recommended I should have my MySQL server separate from my Apache/PHP server in case of hacking and such.

By visiting linode, slicehost and various articles here on serverfault I've managed to cobble together a decent set of instructions on how to do the Apache/PHP bit. I'm using Rackspace VPS and they provide an internal IP for each server.

If I setup a MySQL VPS, should I assume that I would just add the internal IP for the database host? And I guess that I would only need to open up my default ssh port and mysql ports and install phpmyadmin on there?

Ideally I would have webserver.mydomain.com and dbserver.mydomain.com (two 256mb VPS's) with servermin on webserver.mydomain.com and phpmyadmin on dbserver.mydomain.com.

If anyone has any guides or advice on how to setup this type of solution I'd be more then grateful!

Answer 1

Someone recommended I should have my MySQL server separate from my Apache/PHP server in case of hacking and such.

The most common MySQL exploits will be launched through your web application.

MySQL is typically moved to a separate server to improve webserver performance, not database security.

If I setup a MySQL VPS, should I assume that I would just add the internal IP for the database host?

Unless you trust everyone else on your hardware node(s), I think it'd be a better idea to use stunnel.

two 256mb VPS's

You (and your site's visitors) will probably have a much better experience if you just get one 512 MB VPS and maintain patched versions of any software which depends upon MySQL.

Answer 2

This depends on your VPS hosting company. Different VPS hosts have their networks setup differently. I have not worked with rackspace's VPS offerings so I cannot give you detailed setup instructions. It is a good idea to have the two separated though for security (and possibly performance depending on how their servers are virtualized and network is configured). Make sure to cut off your MySQL servers connections to the internet (except SSH of course so that you can still maintain it yourself). Use the internal IP of your MySQL VPS to connect to your Apache VPS. If you lock down your MySQL server then the only way hackers can get access to your precious data in your database(s) is through the Apache server. This makes things much harder for them. Of course if there is gaping security flaw or three in your PHP then you still may have a gaping hole leading to your data...

P.S. As danlefree said, it would be good to make the connection between your two VPS as secure possible utilizing stunnel or other encrypted tunnel.