Mysql – Is using MySQL Workbench over the Internet safe

MySQLremote-accessSecuritysql

Let's say I have a server with an SQL Database somewhere on the other side of the planet. Is it safe to establish a connection over the Internet? e.g. with MySQL Workbench.

I'm asking because I heard that connections to servers, particularly using said software, are by default unencrypted. If I force SSL for every remote connection, what risks remain? Is an open MySQL port a security risk in itself?

Best Answer

The MySQL Reference Manual has a whole Chapter 6 for Security.

First, you shouldn't allow connections from anywhere over the internet, but only from the known trusted hosts. While the user also have list of allowed hosts, 6.1.1 Security Guidelines suggests doing this on firewall level, before the hosts even gets connected to your MySQL Server (default port 3306). This increases security as it also prevents using any potential exploits.

If you really need to have direct connection between your local Workbench and remote MySQL Server, Use Secure Connections. But there are other ways of securing the connection to your SQL server, too. Considering the effort needed for the access control and securing the SQL connection with OpenSSL, they are much more practical:

Use a SSH tunnel and you can connect your MySQL server just like the Workbench was there. This example binds local port 13306 and tunnel connections to localhost:3306 on remote side:
```
ssh -L 13306:localhost:3306 user@sql.example.com
```
Use VPN and allow connections from the internal VPN network only.

With both of these approaches you can bind MySQL to localhost only; it's the most secure option.

Related Solutions

Mysql – How should I set up protection for the database against sql injection when all the php scripts are flawed

The simple answer is "You can't really secure against SQL injection at the database level". Once they're connected to the database with a query in hand your DB is going to execute it -- if someone has injected nastiness into that SQL the best you can hope to do is mitigate the damage they can do.

In terms of damage mitigation what you already described is a great approach: restrict each script to using a database user account that is limited to the minimum access that script requires (Select, Insert, Update, Delete & only to the specific subset of tables that script must touch).
This doesn't secure your database from SQL injection -- It just limits the amount of data someone can steal (or destroy) based on the script they compromised. A determined attacker will probably attack the "interesting" scripts first, which have the juicy data they want in the first place.

In terms of unforeseen problems, the separation into user roles may provide only a minimal security gain (if you have lots of complex cross-table queries and scripts that do multiple things) at the risk of sever breakage (especially if you have lots of complex cross-table queries of scripts that do multiple things).

It's worth noting that auditing your database at this level will probably take as much time (if not more) than replacing all your current calls with proper parameterized queries that make SQL injection attacks either difficult or impossible.

Mysql – thesql workbench behind proxy

Try socat (http://www.dest-unreach.org/socat/)

You can create a local file socket and connect it through a proxy (HTTP or SOCKS4/4A). Something like:

socat UNIX-LISTEN:/tmp/mysql-proxy-socket,fork \ 
  SOCKS4:socks.example.com:mysql.example.com:3308

socat UNIX-LISTEN:/tmp/mysql-proxy-socket,fork \
  PROXY:squid.example.com:mysql.example.com:3308,proxyport=8888,proxyauth=user:pass

Best Answer

Related Solutions

Mysql – How should I set up protection for the database against sql injection when all the php scripts are flawed

Mysql – thesql workbench behind proxy

Related Topic