Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

Server Location

|

239

database server and the database server accepts a connection to port 3306 only from

the host containing the web server.

For less precious data, the MySQL server may be on a dedicated machine in the

outer DMZ, side by side with its clients. This is a common configuration for secu-

rity, performance, and economic reasons. Configure iptables on the database server

to accept connections on port 3306 only from the web server, and configure iptables

on the web server to allow access to the database server on port 3306.

For local client access, MySQL can use a local Unix domain socket, avoiding TCP

exploits. If a client accesses the host as localhost, MySQL automatically uses a Unix

domain socket. By default, this socket is the special file /tmp/mysql.sock.

Secure Remote Administration

Although we worry most about the security of the connection between the database

server and its major clients, we also need to pay attention to the back door: adminis-

trative use.

Database administration includes creating and modifying databases and tables,

changing permissions, loading and dumping data, creating reports, and monitoring

performance. The main methods for administrative access are:

• VPN to the server

• ssh to the server

• Tunneling a local port to the server

• Using the Web

VPN ...