For various reasons I need one of the databases from intranet MySQL server to be made available to (insecure) online server. Due to the requirements it was decided that a db dump will be used via cron to transfer data as the firewall does not allow any connections to be initiated from outside. Then MySQL Master-Slave solution was suggested. From what I have understood, the slave should be able to connect to the master via (preferably insecure) TCP protocol. Such a solution is preferable, however, via secure TCP connections without permitting the slave to initiate (possibly lost) connections to the master.

I would like to know if it is possible to have Master-Slave replication via secure TCP where connections are always initiated by the Master to the slave. The use case does not require too much data transfer, and data base size is within 5GB on a 1GBPS intranet. It is acceptable that there could be some delay in updating to the slave.

  • Can SSL be used in your case? dev.mysql.com/doc/refman/5.7/en/… – shx Feb 27 '16 at 13:08
  • Yes, SSL can be used. – Quiescent Feb 27 '16 at 13:10
  • Can self-signed certificates be allowed? – Quiescent Feb 27 '16 at 13:12
  • How do you suppose to reverse the connection direction, if it's always a slave who initiates one ? By the way I see no reason to ask inital question: of course it's possible, it's an ordinary TCP session. – drookie Feb 27 '16 at 13:21

Rather than exposing your database's ports to the public network at all, I would recommend arranging for the services to be able to see each other by more secure means.

The SSH tunnel option already mentioned will work, though for reliability you'd want to look into making sure that the tunnel remained active after a network blip or other event (look into autossh, or hooking your SSH tunnel into init/systemd).

I would instead recommend a "proper" VNP solution. OpenVPN is common (available in just about all Linux distributions' standard repositories) and easy enough to setup (IMO), though there are many other options. If you setup a point-to-point VPN between the two hosts (or a more general arrangement if more machines need to take part) then the database instances will be able to connect to each other securely over that without needing to be exposed to the outside world.

| improve this answer | |

For remote replication behind NAT you can use a SSH tunnel so you are not exposing db ports directly to the public network. The replicated traffic is encrypted at that point.

Checkout: https://www.digitalocean.com/community/tutorials/how-to-secure-mysql-replication-using-ssh-on-a-vps

You could establish a connection from the inside to the remote server or remote network over a ssh tunnel.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.