Title has it all, is it recommended practice on production servers to change the default port?


Others on this system (and elsewhere) have convinced me that there's nothing necessarily wrong with security-through-obscurity, but it must never be your only line of defence.

Run it on another port, by all means, but don't let that stop you from firewalling aggressively, ensuring that only strong passwords are used, and wrapping the connection in SSL or (better) a VPN, if external systems must connect to your MySQL service across the public internet.

If your only defence is to run it on a non-standard port, someone else running a port scanner will find it sooner or later (probably sooner), and your defences are holed.

  • 2
    Actually putting SSL even on internal-only traffic can be a good thing. It's a trade off between easy scanning of the traffic with a network IDS and protecting the traffic and passwords from malefactors with access to the network from intercepting it.
    – mtinberg
    Jan 12 '11 at 15:42
  • 1
    The line I tend to use is, "Obscurity is not security, but it can be a mitigating factor."
    – Scott Pack
    Jan 12 '11 at 15:48
  • +1 Agree with packs, also. Security through obscurity is a security component, not a security solution. Never solely rely on it alone.
    – squillman
    Jan 12 '11 at 18:41
  • +1 for '...it must never be your only line of defence.'
    – atroon
    Jan 12 '11 at 19:35

Being on a non-standard port protects you from brute-force scripts that assume the standard port, but:

  • This will not protect against scripts that do a port-scan or similar to see if mysql is listening somewhere other then the default port, or something that manages to glean the right port to try from information elsewhere
  • If your database server is acting only for an application (i.e. it is serving web applications, not users directly) then nothing but your web server machines should be able to connect anyway: make sure what-ever port it is running on is protected so only the few hosts that should connect can connect
  • If users other than an application user do need to connect, good password policies and correctly managed permissions are what is needed (and perhaps only let them connect over a VPN or SSH tunnel rather than opening the mysql port to the wider network)

Having it on a non-default port does no harm, but unless the other security is in place it does little real good (it at best increases the amount of time between successful hacks rather than removing the risk) and with the other security in place moving to a different port won't be needed.



SQL security comes from

  • well-adjusted user privileges
  • Firewalling for networks not needing any access to MySQL ports


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.