Connect to MySQL DB from another network with restricted IP Address - mysql

As I know we can create Users like:
'Test01'#'localhost' (which means Test01 can access to MYSQL DB only from localhost)
'Test01'#'192.168.0.150' (which means Test01 can access to MYSQL DB only from internal network with the client having 192.168.0.150 IP address)
'Test01'#'%' (which means all IP can access)
What I want to achieve is to allow Test01 to access MySQL DB from ANOTHER network (example public IP: 1.2.3.4) and this network has a client with static local IP 192.168.0.150, where I want to restrict only this local IP can access mySQL DB.
If I create user like 'Test01'#'1.2.3.4', this will allow all the local IP under '1.2.3.4' to connect to mySQL DB, where I only want a single client with static IP 192.168.0.150 to connect to mySQL DB.
MySQL server is already exposed to the internet via port forwarding.
Can we possibly achieve this?

Follow these steps:
Log in to your MySQL server by using the following command:
mysql -u root -p
Enter your root password after it prompts for it
Use GRANT command to enable access for the remote user. Here db implies as database name, dbuser as database user and ip-address as the remote IP from where it is going to be accessed.
mysql> GRANT ALL ON db.* TO dbuser#'ip-address' IDENTIFIED BY 'your_password';
Above GRANT command grants ALL permissions to the dbuser to connect from the specified IP address by using the specified password.
Finally test the connection remotely:
mysql -u dbuser -p -h ip-address
Enter password:

Related

Use same database with different computers on same lan [duplicate]

I have MySQL setup in a PC on my local network, how do I connect to it?
I also have MySQL installed on this computer (which I want to use to connect to the database).
I tried the following but it's not working:
mysql -u user -h 192.168.1.28:3306 -p password
ERROR 2005 (HY000): Unknown MySQL server host '192.168.1.28:3306' (0)
EDIT
Thanks for your help. Anyway, I connect without 3306 and I have another problem. MACBOOK is the name of my client computer.
mysql -u user -ppassword -h 192.168.1.28
ERROR 1045 (28000): Access denied for user 'user'#'MACBOOK' (using password: YES)
Thanks.
That was a very useful question! Since we need to run the application with a centralized database, we should give the privileges to that computer in LAN to access the particular database hosted in LAN PC. Here is the solution for that!
Go to MySQL server
Type the following code to grant access for other pc:
GRANT ALL PRIVILEGES ON *.* TO 'root'#'%' IDENTIFIED BY 'root_password';
then type:
FLUSH PRIVILEGES;
Replace % with the IP you want to grant access for!
Users who can Install MySQL Workbench on MySQL Server Machine
If you use or have MySQL Workbench on the MySQL Server PC you can do this with just a few clicks. Recommend only for development environment.
Connect to MySQL Server
Find this option Users and Privileges from Navigator and click on it.
Select root user and change value for Limit to Hosts Matching to %.
The click Apply at the bottom.
This should enable root user to access MySQL Server from remote machine.
Since you have MySQL on your local computer, you do not need to bother with the IP address of the machine. Just use localhost:
mysql -u user -p
or
mysql -hlocalhost -u user -p
If you cannot login with this, you must find out what usernames (user#host) exist in the MySQL Server locally. Here is what you do:
Step 01) Startup MySQL so that no passwords are require no passwords and denies TCP/IP connections
service mysql restart --skip-grant-tables --skip-networking
Keep in mind that standard SQL for adding users, granting and
revoking privileges are disabled.
Step 02) Show users and hosts
select concat(''',user,'''#''',host,'''') userhost,password from mysql.user;
Step 03) Check your password to make sure it works
select user,host from mysql.user where password=password('YourMySQLPassword');
If your password produces no output for this query, you have a bad
password.
If your password produces output for this query, look at the users
and hosts. If your host value is '%', your should be able to connect
from anywhere. If your host is 'localhost', you should be able to
connect locally.
Make user you have 'root'#'localhost' defined.
Once you have done what is needed, just restart mysql normally
service mysql restart
If you are able to connect successfully on the macbook, run this
query:
SELECT USER(),CURRENT_USER();
USER() reports how you attempted to authenticate in MySQL
CURRENT_USER() reports how you were allowed to authenticate in
MySQL
Let us know what happens !!!
UPDATE 2012-02-13 20:47 EDT
Login to the remote server and repeat Step 1-3
See if any user allows remote access (i.e, host in mysql.user is '%'). If you do not, then add 'user'#'%' to mysql.user.
Follow a simple checklist:
Try pinging the machine ping 192.168.1.2
Ensure MySQL is running on the specified port 3306 i.e. it has not been modified.
Ensure that the other PC is not blocking inbound connections on that port. If it is, add a firewall exception to allow connections on port 3306 and allow inbound connections in general.
It would be nice if you could post the exact error as it is displayed when you attempt to make that connection.
mysql -u user -h 192.168.1.2 -p
This should be enough for connection to MySQL server.
Please, check the firewall of 192.168.1.2 if remote connection to MySQL server is enabled.
Regards
In Ubuntu Follow these steps:
Set bind-address at /etc/mysql/mysql.conf.d
Change bind-address = 127.0.0.1 to bind-address = 192.24.805.50 # your IP
Grant permission for the remote machine
mysql>GRANT ALL PRIVILEGES ON *.* TO 'root'#'[remoteip]' IDENTIFIED
BY 'anypassword' WITH GRANT OPTION;
Then try connect from remote machine
mysql -u root -h 192.24.805.50 -p
Connecting to any mysql database should be like this:
$mysql -h hostname -Pportnumber -u username -p (then enter)
Then it will ask for password. Note: Port number should be closer to -P or it will show error. Make sure you know what is your mysql port. Default is 3306 and is optional to specify the port in this case. If its anything else you need to mention port number with -P or else it will show error.
For example:
$mysql -h 10.20.40.5 -P3306 -u root -p (then enter)
Password:My_Db_Password
Gubrish about product you using.
mysql>_
Note: If you are trying to connect a db at different location make sure you can ping to that server/computer.
$ping 10.20.40.5
It should return TTL with time you got back PONG.
If it says destination unreachable then you cannot connect to remote mysql no matter what.
In such case contact your Network Administrator or Check your cable connection to your computer till the end of your target computer. Or check if you got LAN/WAN/MAN or internet/intranet/extranet working.
actually you shouldn't specify port in the host name. Mysql has special option for port (if port differs from default)
kind of
mysql --host=192.168.1.2 --port=3306
You don't have to specify ':3306' after the IP, it's the default port for MySQL.
And if your MySQL server runs with another port than 3306, then you have to add '-P [port]' instead of adding it to the IP address.
The MySQL client won't recognize the syntax "host:port", you HAVE to use -P [port] instead.
And btw, if you use '-p password', it won't work and will ask you the password again. You have to stick the password to the -p : -ppassword. (still, it's a very bad habit, because anyone that could do a PS on your server could see the plain password...)
You should use this:
>mysql -u user -h 192.168.1.2 -P 3306 -ppassword
or this:
>mysql -u user -h 192.168.1.2 -ppassword
...because 3306 is a default port number.
mysql Options

How does MySQL determine host of client when connecting remotely?

I'm trying to establish a connection to a MySQL server on a remote host. Both machines are running RH 7.5 and MySQL 5.7.
I can connect to the server as a root user. I did that, and used it to set up a secondary user like this:
CREATE USER 'foo'#'client-ip-address' identified by 'my-password';
and then
GRANT ALL PRIVILEGES ON my-db.* to 'foo'#'client-ip-addres';
That all went fine. But to my surprise, when I tried to connect using this new user, I got an error I wasn't used to:
$ mysql -u foo -h server-ip-address -pmy-password my-db
Access denied for user 'foo'#'some-hostname-not-an-ip.com' (using password: YES)
I know the IP address of the client (where I'm connecting from), which is why I set up the user with that value in the "host" column on the server. But the client is obviously trying to establish a connection using a value for "host" that is not the IP address. Instead it's some hostname, and not an IP address at all.
Where is this value coming from? How does mysql determine its own host when it tries to connect to a remote server? In the past I've only ever seen it use the machine's own IP address.

Why does the mysql % permission not work for all remotes on EC2?

I had a mysql admin issue with permissions on % hosts.
EC2_DB launched with IP 10.55.142.100 and DNS ip-10-55-142-100.ec2.internal
EC2_web launched with IP 10.55.142.144 and DNS ip-10-55-142-144.ec2.internal
EC2_DB and EC2_WEB are in the same security group with access across the DB port (3306)
EC2_DB has a mysql DB that can be reached locally and fully administered by the DB root user.
EC2_DB mysql DB has a remote user 'my_user'#'%' IDENTIFIED BY PASSWORD 'password'
A bash call to mysql from EC2_WEB fails: mysql -umy_user -p -h ip-10-55-142-100.ec2.internal, as does host references to the explicit IP, public DNS, etc.
Step 6 seems to fail because the mysql DB has the wrong user permisions. It needed this:
GRANT ALL PRIVILEGES ON *.* TO 'my_user'#'ip-10-55-142-144.ec2.internal' IDENTIFIED BY PASSWORD 'password'
I would like to think that % would work for any remote server, but I did not find this to be the case.
Please let me know why I cannot use % here.
As it stands now, I will need to add the host-specific permissions for every client in my cluster, which is much more overhead (despite the improved security)

Remote MySQL host thinks I'm on a different host

I'm trying to connect to a remote host, dev, from my webserver. When I do this command from the webserve composer.domain.com: mysql -u username -ppassword -h dev.domain.com, I get an error after authenticating that says access denied for username#sports.domain.com.
sports.domain.com IS a valid vhost on the webserver, but it's one of 14, and it's not the primary host, nor the one the IP resolves to via DNS.
Any idea where I should look to figure out why MySQL thinks I'm coming from sports.domain.com instead of the expected composer.domain.com?
During creating the mysql user, it should be specified the host where the user is allowed to connect. By default it is localhost. Try to add other user account on the database server try the following:
CREATE USER 'username'#'%'
IDENTIFIED BY PASSWORD 'password';
OR
CREATE USER 'username'#'sports.domain.com'
IDENTIFIED BY PASSWORD 'password';
% - it means that all clients are allowed to connect using user account.

MySQL permission denied from local but can connect remotely

I am trying to connect to my mysql database on a remote server (via ssh) through the command:
mysql -u me -h mydomain.com -p
But it fails with a ERROR 1045 (28000): Access denied for user.. error
While
mysql -u me -h localhost -p
Works
Now this isn't just because I have not setup permissions, because the permissions to this database are set for % or any host for the me user.
This is proved by the fact that I can connect correctly from my local machine to the server, using the same user. i.e. running the following command from my local machine works:
mysql -u me -h mydomain.com -p
So my question why does this happen and how can I fix it? Why can I not connect to my mysql server from my server when I use the domain name instead of localhost, even though the permissions are setup to accept connections from any host.
This happens because of the way MySQL handles permission grants.
When you connect from a remote host (or from the local host via an external IP), it will match the me#% entry (if there is no specific grant for the particular host you're using!). But when you connect via the loopback interface (the "localhost" IP) or a socket, it will use the me#localhost grant. So you must have two GRANT PRIVILEGES; one for me#localhost and one for me#%.