How to securely connect app and database servers?

Question

(Updated) For a start, I have my app and database on separate servers. It's easy to connect them, except I am not sure how to secure my database server.

Here's what I've already done:

• Ran mysql_secure_installation right after installing MySQL. So, all of these have been taken care of:

  • strong 64 char root password
  • no anonymous users
  • root login only on localhost
  • no test databases

• A non-public network for the inter-server communication (in my my.cnf, there's something like this: bind-address = 10.128.2.18, where 10.128.2.18 is the private network IP address of the MySQL database server).

• A separate user for the database, an unguessable username and 64 char strong password to go with it; and the ip addresses of the user accounts set to the private IP addresses of the app server. I created the user with command like this:

  GRANT ALL ON `app_db`.* TO 'db_user'@'10.128.2.9' IDENTIFIED BY 'password';
  

  The app is wordpress, so I need GRANT ALL ON to avoid any unexpected issues.

Options considered (but not employed):

• I've been told that technologies like SSH Tunnel, SSL, OpenVPN, Tinc, and IPsec are not generally used because they have a performance cost (resource usage due to encryption, latency, etc).

So, whatelse do I need, or am I good enough? How else do others do it? Please be as detailed as possible (link to a tutorial or something you are suggesting would help a lot).

Answer 1

I'm not sure why you've been told that VPN technologies are not generally used. It is correct that they have a performance cost but then again, so does everything! For the amount of data typically moving between an application server and its database server, the CPU overhead of TLS should be negligible, especially on the database server. If that is not the case then look at purchasing SSL-offloading hardware.

My preference is two network cards in the application server. The connection between it and the database server goes over a different network than client traffic.

If a separate network is not possible then my preference is TLS combined with configuring the firewall on the database server to only allow incoming connections from a small number of computers - the application server (obviously), administrative workstations, operations management servers, etc.

Answer 2

MySQL supports secure (encrypted) connections between MySQL clients and the server using the Secure Sockets Layer (SSL) protocol. you could follow this:

http://www.mysqlperformanceblog.com/2013/06/22/setting-up-mysql-ssl-and-secure-connections/

for more information see mysql official site :

http://dev.mysql.com/doc/refman/5.1/en/ssl-connections.html

Answer 3

Use ssh-tunneling. For example:

$ ssh -f -N -L 3307:localhost:3306 db_host

Check port opened:

$ nmap localhost -p 3307

Now you may open encrypt connection to localhost:3307.

Answer 4

I think you need to define first what you are securing against. So far what you've done secures your database from an unauthorized remote login. The suggested secure communication methods (ssh tunnel, SSL connectivity and such) can protect you from someone snooping on the traffic between the application server and the database, which may be needed if there's a public network between them. If they're both on your internal network that may not be such a big issue though.

Other security aspects remain untouched:

• someone having physical or remote root access to either application or the database server;
• someone having access to the database server disk;
• security of your database backup;
• security of your application against attacks like SQL injection or other exploits;
• trust you have in your application and database administrators;
• security of other machines on the same network, from where additional attacks can be launched;

and so on.

Determine what attack vectors are most probable and harmful, then apply security there.

Answer 5

As just mentioned, including the password value on the command line can be a security risk. To avoid this problem, specify the --password or -p option without any following password value: shell> mysql --host=localhost --user=myname --password mydb shell> mysql -h localhost -u myname -p mydb When the password option has no password value, the client program prints a prompt and waits for you to enter the password.