0

I have a server running Apache and MySQL. Connections to MySQL work fine when using localhost in the connection settings.

Now I'd like to force our developers to use a FQDN instead of localhost. This is because we're planning to move the MySQL servers from the application servers to a MySQL cluster. Then we can transparantly move things without the developers having to modify connection settings.

So I created a CNAME DNS record mysql.company.com pointing to the server that is running MySQL. Later on we can point this to the MySQL cluster.

I opened port 3306 on the server, allowed the MySQL users to connect from any host (%) and added the bind-address = mysql.company.com setting to the my.cnf (I also tried with the actual IP of the server, didn't work either). Also omitting the bind-address setting didn't work.

From the server mysql --host=mysql.company.com --user=root --password works fine.

When testing with a simple PHP script (see below) that's running on the same server, I always get a Permission denied error for the FQDN as server name. Using localhost as the server name works fine.

<?php

$servername = "mysql.company.com";
//$servername = "localhost";
$username = "tester";
$password = "my_awesome_pass";

// Create connection
$conn = new mysqli($servername, $username, $password);

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}
echo "Connected successfully";

What am I doing wrong to achieve what I need? And how can I disable MySQL connections to localhost (maybe with the firewall?).

1

As always, a few minutes after posting a question, I found the answer myself. The issue was SELinux. It was set on enforced; permissive made it work instantly. Now I'll have to figure out a way to make it work with the enforced mode.

The following appeared in the audit.log:

type=AVC msg=audit(1429781752.260:6738): avc: denied { name_connect } for pid=40354 comm="httpd" dest=3306 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:mysqld_port_t:s0 tclass=tcp_socket

0

Be sure skip_name_resolve is OFF.

GRANT access for the users from their hosts.

Remove non-root grants for localhost (when you want to really force them to convert).

I assume you have user(s) that are GRANTed access only to the application database(s).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.