I have a hosted MySql server with many databases each with many views. I access the server remotely from my office using HeidiSql.
Once in a while the IP address of my office changes. When this happens, I have to add the new office IP address to the server using cPanel and the "Remote MySql" tool so that I can remotely connect again.
However, all of the views have definer: USER#OLD_IP_ADDRESS. If I need to change a view, I get Access Denied. Up to now, I have been deleting the view (yes, i can delete the view) and recreating it, which makes the view's definer USER#NEW_IP_ADDRESS, and then I can edit the view -- until the Ip address changes again.
So, my question is: What is the best practice is an environment like this. Is there a way to define the views once and, without causing a security risk, be able to edit the views after an IP Address change.
Thanks for any guidance.
You could loosen the host in the MySQL user account a bit, according to the IP range of your internet provider. That way, you don't need to change it every time you get a slightly different IP:
user#123.456.789.%
user#123.456.%
This of course loosens the security in this account, but if your password is be a good one, it should not be too risky.
A better way is to make the MySQL server only accessible via SSH. In that case, your MySQL server can be set up using the --skip-networking option, as you always connecting from localhost. Your user account can be user#localhost or user#127.0.0.1, which then would solve your above mentioned problem for all times.
HeidiSQL also supports SSH tunneled MySQL connections, see here for some tutorial.
Related
I just opened an account on Amazon AWS. In this account, I created a mysql database instance, that I am now trying to connect to on my home computer use mySQL Workbench. I have entered the database endpoint (as listed in my account) and added the user name I set up for the master username for the database. When I hit "test connection" (using standard TCP/IP connection) however, I get a "Failed to connect..." message. I have a feeling that the problem may be that I need to use SSL and/or SSH. But I am a neophyte here, and I don't know how to properly set this up or configure mySQL Workbench with this. I am seeking assistance
You need to allow your mysql server to the user my user policy.
You can allow your Public IP address.
Please refer below case:
Cannot ping AWS EC2 instance
I think there that my database instance was misconfigured somehow, though not as JERRY suggests. I created a new MySQL DB instance and was able to connect to that without needing any other special configuration changes. So I am now using the new instance, and have deleted the old one. I wish I could provide more insight into what the problem with the first DB was, but the insight I have is (as I said) after I created the 2nd DB instance, no other configuration was necessary
I just exported my tables from one web host to another (AWS).
Thinking everything would go smoothly (yeah right), well, everything that can go wrong has gone wrong.
I get this error when trying to query my database (which I didn't get before):
SQLSTATE[HY000] [1130] Host '<my ip address>' is not allowed to connect to this MySQL server
This is the same error from this post:
Host 'xxx.xx.xxx.xxx' is not allowed to connect to this MySQL server
The solution in that post seems to revolve around having an administrative user. I am developing a chat application so every user needs to access the server (so I'm sure it's a bad idea to give them all administrative privileges).
The answer by Pascal in that link says, If you are using mysql for a client/server application, prefer a subnet address. but I honestly don't understand what he means by that. And because of the amount of solutions, I'm not exactly sure which one I should follow based on my case.
How do I resolve this?
MySQL has security tables that determine who is allowed to connect and from what host IP address.
Here's a good article on how to do it:
http://www.cyberciti.biz/tips/how-do-i-enable-remote-access-to-mysql-database-server.html
If you have a lot of connections, consider setting up a server to accept the connections and talk to the sql server. The easiest approach to this is to set up a REST interface and use a web server. Web servers are usually also highly optimized and relatively bug free.
In a similar architecture on AWS, I use nginx happily.
Make sure you have bind-address=YOUR-SERVER-IP in my.cnf and make sure you have a user hd1#172.31.39.86 or hd1#%, the latter being a MySQL wildcard on the MySQL server. More information here. You may also need to grant access to port 3306 (the default MySQL port) on the security groups section of the AWS console.
// IN YOUR MYSQL WORKBENCH You Have to Execute below query
CREATE USER 'root'#'1.2.1.5(Your Application Server IP)' IDENTIFIED BY 'pass';
GRANT ALL PRIVILEGES ON *.* TO 'root'#'10.200.1.54' WITH GRANT OPTION;
AFTER CREATING YOU CAN VIEW USING BELOW QUERY
SELECT * FROM mysql.user WHERE User = 'root';
I have seen a lot of posts that claim they are running an RDS instance of MySql in which they cannot connect to, but I am not running RDS.
I used my EC2 insance to host my wordpress blog which was installed using the Web Platform Installer.
This setup the wordpress schema and data that I needed and I have been running it for a couple years.
I want to be able to access this database remotely instead of only logging into my server.
I have checked and have the following users
root
wpadmin
I have also verified that the port specified in the mysql config is the standard 3306 and I have setup an Inbound Firewall rule to allow 3306 through.
When I try to connect from MySql Workbench, I get the following error message:
Number 3 Is particularly one that I do not know how to check, but I do know that MySql is running and that it is running on 3306. Additionally, I know I am using the correct password.
When I try to connect, the prompt looks like this. Do I need to do something to grant Mysql user permissions or anything?
Based on your GRANT information, you have at least the problem of root user only having access privileges from localhost. You would need to create a root#% user (or a more specific host/IP instead of % if you have a reliable address). That would allow external access so long as your EC2 security group also allow access on port 3306 (either globally or to a more restrictive IP address or IP range).
Of course the security implication here is that you are opening up access to MySQL that you might not want to make more accessbile to potential attackers. For this reason, I would recommend you access your DB via SSH tunnel, which is supported by MySQL workbench. This will in essence allow you to shell into the host your your access key and then access as root#localhost.
i've setup a new mysql user on a server that allows access from other servers. i can access it from my dev machine using the credentials i setup.
But on one of my other servers nothing happens when trying to log into mysql using the same credentials that worked on my dev box. any ideas what it might be?
all it does is hang.
Nothing gets added to log files on either the new DB server or the one i'm trying to access from.
i also tested this connection from another server, just to test if my dev box was a fluke andi could access. So all i can think is there's something "wrong" with the server i cant access from.
Please post your query that executes to create this user and privileges.
If you can’t remember the queries you can execute this in your target server to get details about user
SHOW GRANTS for 'root'#'localhost';
You may check these things also .
Firewall setup for the server from the trouble machine.
Can this machine connect to another sql server provided with similar access?
Execute select * from mysql.user ; and check you don’t have duplicates with
different access privileges or passwords .
turns out i had everything setup correctly, as i said i was able to use the same user across other servers just not this one.
turns out my server provider had a network firewall restricting mysql connections. removed and hey presto.
thanks #csf
I heard that anyone that knows my MySQL Username and Password can access it, Even if it's listening only to localhost.
Supposing my info is as following:
USER: root
PASS: 123456
Host: LOCALHOST (only)
How is it possible that anyone out there (local) can access it?
If you restrict access from remote hosts to your usernames and passwords then someone won't be able to access the database externally.
You could also configure your firewall to only allow traffic to 3306 (MySQL Default Port) from the localhost machine.
Update
To setup your user so they can only access through LOCALHOST use:
GRANT ALL PRIVILEGES ON *.* TO db_user #'localhost' IDENTIFIED BY 'db_passwd';
GRANT ALL PRIVILEGES ON *.* TO db_user #'127.0.0.1' IDENTIFIED BY 'db_passwd';
Also, bind your MySQL server to the local address. You can do this by editing the [mysqld] section of my.cnf:
[mysqld]
bind-address = 127.0.0.1
you can block direct access to MySQL at the firewall or within MySQL itself, but the most likely way you'd be hacked is through an insecure web application - in that situation the attacker would most likely be able to read your database login and connect from the server.
So keep your applications secure - keep everything updated, don't allow file uploads, use suPHP if you have multiple accounts etc.
If you restrict your mysql application follow this steps:
1.You could just block port 3306. If the site is on the same server then it will still be able to access the database using localhost as the hostname.
2.Just add "bind-address = 127.0.0.1" to the "[mysqld]" section of their my.cnf file to restrict access to localhost only.
Most of people use this type of restriction.
This is an older question that I stumbled across, but if Darkeden had phpMyAdmin or similar running, anyone can log in to that using valid MySQL credentials.
If it was compromised, then in addition to restricting connections, change all passwords.
I didn't see an answer that answered his (adjusted) question - he has locked it to localhost and the attacker is still getting in.
If you have truly restricted it to local host (check using netstat -an | egrep 3306 to check it is listening to 127.0.0.1 not 0.0.0.0),
then the only way of accessing it is to originate a connection from that local host.
Initial steps to take:
probably rebuild a replacement system from scratch and hardening it before you make it publicly accessible (having a repeatable recipe eg using ansible will help as you may have to go through a few iterations to learn how he gets in)
Check with reputable security scanners what you obvious holes are,
Get help from a security professional (depends if you want to spend $ or time and frustration to fix)
Apply security patches,
Remove services you don't need,
restrict the database access to only those programs that need it,
redo all your passwords,
check for installed root kits, and other viruses,
secure your server if at your own office and train staff in handling social engineering,
use a service that will monitor and filter the requests coming through and deny direct access (eg use cloudflare as a cheep starting point)
check for keyboard loggers (physical and software and other viruses) on all machines used to access the server),
check for physical means of logging your keystrokes in accessing your server (eg web cam style used in atm), the more exotic include sound (https://en.wikipedia.org/wiki/Acoustic_cryptanalysis), typing with a nearby wifi access point (eg https://www.schneier.com/blog/archives/2016/08/keystroke_recog.html)
Add an audit trail and monitor database activity to work out how he is getting through, but at least you need to do all the obvious securing first because otherwise he will just hop from one security hole to another
He could be also getting through using:
accessing via some program you are running (eg a web server) that is externally accessible and has a security hole that allows him to run arbitrary sql commands through its existing database connection - see https://www.w3schools.com/sql/sql_injection.asp
tricking some program he has access to from outside to proxy a connection for him to localhost:3306 (eg through a miss-configured network firewall on the machine)
tricking some program to run a local program (bash. mysql etc), and from there gaining access to the database - buffer overflows and other specially crafted data is a common issue to running arbitrary code
man in the middle attack on a connection that has legitimate access
bugs in a program that is automatically or manually processing data from outside, eg email, processing of postscript/pdf/any document with scripting processing - even viewing a text file can be dangerous - see https://www.proteansec.com/linux/blast-past-executing-code-terminal-emulators-via-escape-sequences/
social engineering a way through getting people to give you access
managing to get a hardware device attached to a computer that has access (how many people will pick up a "memory stick" lying in the work car park and check it out instead its a "programmable keyboard", and ALL computers trust keyboards!)
and then many more all the other sorts of methods I don't know, but those that are involved share ...
Just remember that you need to have practical security, I think xkcd says it just right: https://xkcd.com/538/