(Updated) For a start, I have my app and database on separate servers. It's easy to connect them, except I am not sure how to secure my database server.
Here's what I've already done:
mysql_secure_installationright after installing MySQL. So, all of these have been taken care of:
- strong 64 char root password
- no anonymous users
- root login only on localhost
- no test databases
A non-public network for the inter-server communication (in my my.cnf, there's something like this:
bind-address = 10.128.2.18, where 10.128.2.18 is the private network IP address of the MySQL database server).
A separate user for the database, an unguessable username and 64 char strong password to go with it; and the ip addresses of the user accounts set to the private IP addresses of the app server. I created the user with command like this:
GRANT ALL ON `app_db`.* TO 'db_user'@'10.128.2.9' IDENTIFIED BY 'password';
The app is wordpress, so I need
GRANT ALL ONto avoid any unexpected issues.
Options considered (but not employed):
- I've been told that technologies like SSH Tunnel, SSL, OpenVPN, Tinc, and IPsec are not generally used because they have a performance cost (resource usage due to encryption, latency, etc).
So, whatelse do I need, or am I good enough? How else do others do it? Please be as detailed as possible (link to a tutorial or something you are suggesting would help a lot).