Recently, one of my centos linux servers was hacked and the cause of due to phpMyAdmin. It was said due to this problem PhpMyAdmin vulnerability CVE-2011-2505 (http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2505). What is the best way to login securely into my mysql db? Any idea please.
-
You can connect with MySQL Workbench (via SSH tunnel).– ypercubeᵀᴹCommented Apr 26, 2012 at 5:55
-
@ypercube but then again I must open port 3306 which will become another threat to me thereafter right?– newbie14Commented Apr 28, 2012 at 16:46
-
No, you only open ssh port (all other communication passes through that, that's why it's called "tunneling").– ypercubeᵀᴹCommented Apr 28, 2012 at 16:55
-
@ypercube ok first I must install the mysql workbench on that particular pc right? Then how to connect cause I saw the website show is port 3306 can you explain further on this?– newbie14Commented Apr 28, 2012 at 17:00
-
You actually don't even need Workbench. Here's a quick intoduction: MySQL ssh tunnel With this, (while the tunnel is working) all applications in your local machine will think that there's a MySQL server, locally at 3307. So, you can connect with either Command Line Interface or Workbench or whatever.– ypercubeᵀᴹCommented Apr 28, 2012 at 17:04
|
Show 2 more comments
1 Answer
Use a VPN connection to connect to the network which is hosting the database server.
A database server should never be directly accessible from the public Internet. If it is directly accessible it will be broken in to. It's just a mater of time.
-
@denny what should I do now? How do you advice me to do it? Setup vpn is it? So internally from server can I call it ?– newbie14Commented Apr 26, 2012 at 7:43
-
When you setup a VPN server at the data center you then VPN into the network via that VPN server (some routers can do this as well). At that point you are on the Data Center network and can log into the MySQL server. I'm not a fan of pushing my book on here, but it's called Securing SQL Server (securingsqlserver.com) while it's aimed at Microsoft SQL Server a lot of the concepts apply to app database platforms, especially the 1st chapter on designing your network with security in mind.– mrdennyCommented Apr 26, 2012 at 21:10
-
@denny the problem I am hosting all my server in data center. So one server is web server and the other db server. So are you saying first log into the webserver and then using that to login into my db server?– newbie14Commented Apr 27, 2012 at 16:18
-
You should setup a separate website on the web server for running admin type apps like PhpMyAdmin and make that website so that it's not accessible from the Public Internet. This way people can't find and access your admin functions via the public website. Having everything on a single site may be convenient, but it it's convenient it probably isn't secure.– mrdennyCommented Apr 27, 2012 at 20:15
-
@denny, Say I got server A(I put now the phpMyAdmin here) then it with locally link to Server B which is my db am I right here? Is this how it suppose to be but if the compromise my server A phpMyAdmin also going to be a problem then right? When you said separate means how you suggest to be done? Thank you.– newbie14Commented Apr 28, 2012 at 7:23