0

I'm trying to find documentation that discusses a secure way to create a permanent connection between an Apache Webserver and a separate MySQL database server. I'm not having a lot of luck finding the standard process to connect the two securely. How is this typically done?

5
  • 2
    What do you mean by a "permanent connection"? Sep 27, 2011 at 15:03
  • I want to install a web application that uses PHP for the app and mysql for the database across two servers. For the application to function is has to talk to the database so I need a connection between the two.
    – JMC
    Sep 27, 2011 at 15:07
  • And the PHP app doesn't have some configuration file that specifies the DB Server??
    – Chris S
    Sep 27, 2011 at 15:11
  • There is a configuration. Actually making it connect isn't the real problem. I'm trying to find the typical process for securing the connection between the two. For example knowing to allow port 80 on the webserver but block port 80 traffic to the database is useful info. I'm sure there's more that I don't know.
    – JMC
    Sep 27, 2011 at 15:15
  • 1
    All traffic should be blocked by default on a computer facing the Internet. Then specifically allow only the traffic you need; this has nothing to do with Apache/PHP/MySQL, it's just basic security. Your webserver needs any IP to be able to get to port 80. The DB server needs only the webserver to be able to get to port 3306. Add management ports/IPs as necessary.
    – Chris S
    Sep 27, 2011 at 15:20

2 Answers 2

1

Have your servers on a private VLAN(s).

If your Application server is 192.168.1.10 and your MySQL server is 192.168.1.11 -

On the MySQL server do a GRANT statement that gives your PHP application's host access to the MySQL server. i.e. GRANT INSERT, SELECT on db.* from appuser@'192.168.1.10' identified by 'password';

In your PHP code specify the MySQL host when you create the connection string:

$link = mysql_connect('192.168.1.11:3306', 'appuser', 'password');

Also need to ensure that your my.cnf doesn't have bind-address=127.0.0.1, if it does no remote connections will be permitted. So comment that out.

2
  • Is there a way to use bind-address with the webserver's ip for security or does that option do something else entirely?
    – JMC
    Sep 27, 2011 at 15:33
  • @JMC, The MySQL GRANT statement does that. i.e. from appuser@'192.168.1.10' The MySQL bind-address option binds MySQL to a particular network interface.
    – HTTP500
    Sep 27, 2011 at 16:04
0

There is no such thing as a "permanent connection" between the web application and the DB Server. The application will open a connection to the SQL server, do its work, and then close the connection when it's done.

The way in which the application connects to the server is determined by the application itself; typically it will have a configuration file in which you will need to set the connection parameters. And what options you have for securing that connection are going to be in part determined by what that application supports and requires.

2
  • Not always true. PHP provides "persistent" connections that are not closed when the script terminates. Other platforms provide connections pools that are kept open and reused.
    – Craig
    Sep 27, 2011 at 16:33
  • @Craig I understand that, my take on what he was asking for was like a "dedicated pipe" so that's sort of where I went. But then I also added that the options he had were going to be determined by the what the application provided. He never specified whether he was working with PHP, Java, or something else so I couldn't be more specific in that regard. Sep 27, 2011 at 16:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .