Safe remote mysql connection

Question

As you know, keeping the mysql port 3306 opened is unsafe - but I would like to use a good mysql administrative program instead of phpmyadmin, which requires 3306 port to be opened.

Of course I can allow only my ip address to connect to 3306 port using ipfw, but the problem is that my IP address change itself every 24 hours, so I would have to add a new rule for every IP address...

I'm using a Windows 7 and want to connect to the mysql server on my dedicated server running of FreeBSD.

Isnt there any nice way to keep mysql safe and using the remote connection?

Answer 1

Create a secure tunnel to the server using SSH port forwarding from your client or some other tool. That way you can have the server only bind to the loopback adapter, and not be publicly available. It will be completely encrypted over the tunnel, and only authorized users will be able to login.

There are many guides about SSH port forwarding on the Internet, here is one.

• http://www.cs.uu.nl/technical/services/ssh/putty/puttyfw.html

Answer 2

This blog post discusses using a DynDNS address and iptables to create a "dynamic" firewall rule through a script that runs frequently, detects any actual IP change, and updates the iptables rules accordingly.

You can try to use that, or to modify the script to suit your (ipfw) needs.

Answer 3

Don't know if this will help you, but I used this a while back. http://www.no-ip.com/

No-ip, you can setup a no-ip name and then use that name instead of your ip. No-ip has a client that automatically updates your no-ip with your current ipaddress so the name always points to the right place.

Answer 4

If you were to use pf instead of ipfw, there is authpf. I'm happily using that on FreeBSD for exactly this purpose.

Answer 5

If you install phpmyadmin on a server it does not require 3306 port to be open since the database is on localhost. Then you can connect to phpmyadmin on your server through https, which is encrypted:

https://yourservername/phpmyadmin