1

I created my application using MySQL and it relies completely on the database I have around 190 tables, and I'm afraid of security breaches and another problem is for remote access I have to add the IP addresses of the devices that would use it, and since they change dynamically I will need to regularly update the remote access IP addresses, what is a better option for the connection with the remote MySQL? Currently I'm hosting it on my account at hostgator.

For now, the application is under a testing period so, I have time to change my approach with the database connection, It's a desktop application created using c# and visual studio 2013.

My question might seem silly but this is my first real life application so, I don't want to be a mess! Thanks

  • Have you looked into SSL? You can also specify subnets when you grant privileges - i.e. GRANT SELECT ON mydb.* TO ''@'12.23.*.*'; i.e. select on any table in the mydb schema to any user from IP address 12.23.<whatever>. – Vérace May 11 '15 at 18:27
  • @Vérace the problem is the ip addresses are dynamic, they change completely like sometimes they are 5.41.*.* and other times they are 95.*.*.* so, I don't know what I can do to solve this issue. – amateur programmer May 11 '15 at 18:32
  • SSL can be used for the database itself? – amateur programmer May 11 '15 at 18:36
  • See this page about logging into MySQL using SSL. I'm more in the academic world myself, so security is a minor concern. Re. your variety of IP addresses - restrict as much as you can- you can issue two (or more) grants for the same user. – Vérace May 11 '15 at 18:48
  • same here, my knowledge related to security is very small and this is my first application that people will actually use in the long term which is why I'm concerned – amateur programmer May 11 '15 at 21:33
1

What are the clients? PHP? Java? (etc, etc) There are potentially serious hacks that can do things like "SQL Injection" through them. That is perhaps more common than IP restrictions.

Do you have root only from some secure place? Does it have a hardened password?

Are all the application 'users' granted access only to the desired database, and with only the desired permissions? And are all the passwords hardened?

Where are the client passwords? Visible in code? That is, if a hacker can get to the code, are the passwords a useless defense?

SSL is only one issue. If your provider does not allow for SSL, see if someone else does. If not, then consider hosting the servers yourself; it's cheaper in the long run, but much more work. And it would solve the IP problem.

Check skip_name_resolve.

  • As I pointed out earlier, I'm using C# no php or java, and SQL injections won't be an issue I guess because the application will be used within a school and installed on 5-10 computers only and most of the users are noobs when it comes to programming and stuff like that. My main concern is outsiders those who know that this school has an application and might want to harm them. And yes the password of the database and username are all within the code itself but then again, the application will be installed in their desktops and the chances of hacking from within the institute are very small. – amateur programmer May 11 '15 at 21:29
  • What do u mean by do u have root only? and I think hostgator does provide SSL. – amateur programmer May 11 '15 at 21:29
  • root should have access to the database from as few places as possible. Usually that means GRANT ALL ON *.* TO root@localhost ...; and nowhere else. Then you harden the server to help prevent anyone from connecting as root. – Rick James May 11 '15 at 21:53
  • @RickJames if I fix the root thing and the SSL I won't have anything else to worry about? Sometimes I just think about making all the pcs connect to one main pc which would stay open and online all the time and let the database be open there all the time. but then again they would need someone to start the local host for them and I think they don't have any IT expert over there – amateur programmer May 12 '15 at 0:30
  • btw right now I have added the wild card %.%.%.% for the remote access just so they can test the application without problems related to the access. But I know this is very very bad! but for now it is ok coz there is no real data on the database – amateur programmer May 12 '15 at 0:35
1

It looks like you might need to use a DDNS service from a service such as www.no-ip.com, then filter on DDNS name. The client will have to update their IP on the dynamic dns system though.

Have you considered running the db engine on a non standard port with very strong passwords and all the security best practices presented, then letting the clients connect that way? You'll know if someone is really attempting to hack you if you see them attempting multiple or default passwords against your non standard port, that means they know it's a MySQL or some sort of DB back there. You can log that info or even alert on it if you'd like.

  • How can I use a non standard port? www.no-ip.com is blocked in my area unfortunately. – amateur programmer May 11 '15 at 21:24
  • heya bud, check out: cyberciti.biz/faq/change-default-mysql-port-under-linuxunix That should do it for you. Any of the DynamicDNS providers will work for you, heck, you can even put it in your own local host file and reverse DNS. That should work but I never tested it. – Ali Razeghi May 11 '15 at 21:44
  • Using a non standard port is merely security through obscurity and, while it may deter the casual hacker, is not a good long term solution. Do you need to connect through the MySQL client? How does you app connect to the database? – Vérace May 12 '15 at 12:46
  • @Vérace There are two ways in which I connect to the database one is through c# code that one is used for CRUD of the data and I have crystal reports in the application for them I have to connect through a mysql client on ODBC. – amateur programmer May 12 '15 at 14:35
  • Well, then I humbly suggest that this is not the forum in which you should be asking your question. This is more about security in programming using the tools (C# and Crystal Reports) you have chosen, rather than being about securing your database. I think you should ask about this on Stack Overflow or C#/CR forums. – Vérace May 12 '15 at 15:22
1

Here are a couple of options that help with security. A simple step is to not use the default 3306 port. Also, use very hardened passwords and if possible, change passwords often. A trick that I have done is instead of having your application communicate directly to your mysql server, have it communicate via PHP to an Apache server running on the same server as mysql. Then you can have the mysql port blocked and only accessible by Apache. Put Apache on a non-standard port and then have your program send your mysql query via post to Apache and then Apache can make the request to mysql via PHP. Make sure to keep your mysql user/pass that the PHP script uses in a folder that is not directly accessible by Apache in case your Apache server gets hacked.

  • Sounds interesting, Can you enlighten me more about this php and apache thing? I heard about using JSON and php for the database manipulation but I got scared from using it because these are going to be pages that are visible online to anyone who has the links or am I wrong about this? Sorry but I'm not a professional as I said this is my first real life project – amateur programmer May 11 '15 at 21:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.