Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

As you know, keeping the mysql port 3306 opened is unsafe - but I would like to use a good mysql administrative program instead of phpmyadmin, which requires 3306 port to be opened.

Of course I can allow only my ip address to connect to 3306 port using ipfw, but the problem is that my IP address change itself every 24 hours, so I would have to add a new rule for every IP address...

I'm using a Windows 7 and want to connect to the mysql server on my dedicated server running of FreeBSD.

Isnt there any nice way to keep mysql safe and using the remote connection?

share|improve this question

5 Answers 5

Create a secure tunnel to the server using SSH port forwarding from your client or some other tool. That way you can have the server only bind to the loopback adapter, and not be publicly available. It will be completely encrypted over the tunnel, and only authorized users will be able to login.

There are many guides about SSH port forwarding on the Internet, here is one.

share|improve this answer
    
Thanks, but now I get a mysql error while connecting: Lost connection to MySQL server at 'reading initial communication packet. –  Cyclone Feb 26 '12 at 8:40
    
Did you setup the tunnel in putty from 3306 to localhost:3306? In your mysql admin client you connect to the tunnel by telling it to connect to localhost:3306. Can you run netstat on the server and verify that mysql is actually listening for network connections? That isn't always enabled, it could just be using a socket. –  Zoredache Feb 26 '12 at 9:32
    
I've set source port to: 7777, destination to: my-remote-address.com:3306. It means I should now be able to connect to my remote host via 7777 port. Could you give me some tips regarding netstat? –  Cyclone Feb 26 '12 at 10:12

This blog post discusses using a DynDNS address and iptables to create a "dynamic" firewall rule through a script that runs frequently, detects any actual IP change, and updates the iptables rules accordingly.

You can try to use that, or to modify the script to suit your (ipfw) needs.

share|improve this answer

Don't know if this will help you, but I used this a while back. http://www.no-ip.com/

No-ip, you can setup a no-ip name and then use that name instead of your ip. No-ip has a client that automatically updates your no-ip with your current ipaddress so the name always points to the right place.

share|improve this answer
    
;) but I can not paste my no-ip domain as a firewall rule, because it does require a valid IP address. –  Cyclone Feb 26 '12 at 8:25

If you were to use pf instead of ipfw, there is authpf. I'm happily using that on FreeBSD for exactly this purpose.

share|improve this answer

If you install phpmyadmin on a server it does not require 3306 port to be open since the database is on localhost. Then you can connect to phpmyadmin on your server through https, which is encrypted:

https://yourservername/phpmyadmin
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.