Are there any database only hosting services?
I need a MySQL only hosting service but I couldn't find any. All mysql hostings are part of a package e.g. PHP + MySQL.
I need it for development purposes. Having my PHP files somewhere else I can remotely connect to this mysql server and once an application is ready I can put that on a server having both PHP + MYsql. [well, there a some reason to have this kinda setup, if you have something to suggest please do.]
Any suggestion/recommendation if you have used any.
Thanks
The problem with a database-only host would be the security. The database need to be accessed over the Internet, thus username and password to access it are sent over the Internet. Even though you could add encryption and other protection, there's still a risk that the security is breached.
In general, you should never allow direct access to databases over the Internet! It's a real bad practice, which also explains why it's hard to find.
One way to get around such limitation is by building a web service around your database. In this web service you'll add all the functionality that you need to apply on this database, and the web service itself will keep the database itself protected. There would still be a risk that your web service gets compromised but even in that case, the attacker could never do more damage than the specific web service allows.
Such a web service can be created in PHP, although I myself have more experience with doing something similar with .NET and C# on SQL Server...
I think that you can find hosts with MySQL and PHP cheap enough that it would be easiest for you just to use one of those hosts and only use what you need.
Web Hosting Buzz has a plan for $5.95 (a month) which has unlimited databases, 400GB storage, and 500GB/Month data transfer.
A few weeks after the question was posted, Amazon announced a beta of "Amazon Relational Database Service (Amazon RDS)." It acts like MySQL 5.1.
http://aws.amazon.com/rds/
Seems pricey for what you want, but you never said you were the one who would be paying the bill.
Contract a dedicated server.
Use it only to host your MySQL database
If the server is managed, they should help you with basic MySQL problems as it is usually preinstalled. I use http://www.hostingmatters.com/
If you are just needing this for developement purposes for PHP + MySQL why not just install EasyPHP (http://www.easyphp.org/). This installs quickly and easily and I think it's great for developement.
I've had no problems installing additional PEAR extensions and such after the fact with this.
There's a free option on Heroku and paid options up from there: https://addons.heroku.com/cleardb
You can try freemysqlhosting.
http://freemysqlhosting.net/
Related
I'm setting up an application on Heroku that uses a MySQL database.
The client would like to use a MySQL database that has an explicit whitelist that allows it to connect. However, due to the dynamic IP nature of Heroku, this proves to be quite complex; we have to use an add-on such as QuotaGuard to provide us a static IP in which we can access the database.
This proxy routing is causing issues for us in other places as other services that use dynamic IPs are attempting to access the database and are failing.
My question is the degree of security a whitelist really provides rather than a complex username/password with SSL.
Has anyone had experience with the two and can speak to the advantages disadvantages?
Thanks
Allow me to rephrase your question:
What is the advantage of setting up a complex dynamic IP tracker system vs. simply securing the link?
An IP can be spoofed, by the way, so this solution is not that secure (right, such an attack requires some non-trivial black magic, but is quite feasible in fact).
Configuring MySQL for SSL support is really not that complicated and very well documented.
And if you can't recompile or reconfigure MySQL, you can still establish a simple VPN between your client application and your MySQL server (and only allow connections from this VPN).
Unfortunately, I don't know if your provider allows this level of configuration on your instances.
So if all of the above in not possible, you can still create a random 10000-character long password. Not secure enough for a purist, but I wish the hackers good luck :)
I have been running a MySQL Community Server for a couple of years now and a new client has asked for a report from a vulnerability scanner on our network. I am using OpenVAS and the network is fine apart from the server, its returning a high threat stating that a MySQL security patch needs to be applied. I've gone onto the Oracle website and I believe that I require a Support Identifier to apply the patch, so I done some Googling and its basically a subscription from Oracle. As its a small company is there a way to apply this patch for the community edition without the need to fork out a ton of money, or shall I just filter incoming traffic to the mysql port (Its not the actual fix but at least its one)?
Cheers for the help!
A first measure would be closing the MySQL port through a firewall (iptables), or at least restricting it to the machines in the internal network needing direct access to MySQL.
As for the patch: Maybe there are newer pre-built packages for your OS/distro which already contain the bugfix.
I am creating a web service for a small company which will use client authentication and possibly https for a RESTful service. I am asking a very simple question that I hope is not too broad, but I am very new and naive to internet security. What precautions must I take to ensure my data is secure?
To describe my service a bit, users have an account where they place presumably insensitive information and retrieve it from a database using a homemade authentication token I create on successful login with a salted password. I am using an amazon instance where MySQL is local and access is granted remotely to me so I can access it directly from my home. I am using a few php scripts to do my work requesting and adding data and am attempting to protect against injection. I am storing my MySQL credentials in a separate file from the php scripts. I can only ssh into my server with a pem file that I believe is safe.
My biggest fear is that someone will come and delete all of my data. What other precautions must I take? Thanks
If you're using Amazon EC2 then you should make use of their security groups to lock down your MySQL server and ensure that no external access to it is possible.
Application servers have an internal non-routing 10.x type IP that should be used for access control, and any external IPs, like your home network, should be specifically whitelisted if VPN access or SSH tunnelling is not practical, as those two are far easier to secure.
Be absolutely sure that no credentials, configuration files, or keys are stored anywhere in your web root. That is, should you accidentally misconfigure your application server in the worst possible way, with directory indexes turned on and everything, it's not possible to snag anything critical.
You might also want to specifically exclude the downloading of *.inc in case you make a mistake. The idea here is to set up a number of safeguards you'd have to break before things go horribly awry. A single-mistake failure situation is always the result of bad planning.
Above all else, be extremely vigilant about proper SQL escaping to avoid SQL injection bugs as no amount of firewall security on your MySQL server will help you when someone can drive a truck through a mistake in your code and have free reign on the server. It's recommended to thoroughly audit any SQL interfacing code you've written before going live with it.
Be sure to have a proper deployment procedure that uses a version control system. If you ever have an intrusion it's very easy to roll back to a known-good version of the code if you have one. The 1990s style "throw files at server with FTP" deployment approach is hazardous at the best of times and fatal to your business when it goes wrong. Use version control or you're living on borrowed time.
I have a dedicated server with WHM and cPanel installed on it.
recently I decided to move to cloud services since the dedicated server is costly and I'm not actually using any of its power, freedom and functionality.
I was considering moving to AWS or Heroku since they are less expensive, scalable and I don't need to manage the server myself.
I only have few websites on my server and I'm managing them via cPanel and WHM
I'm only using mySql database
I have also have some cron jobs setup
I use ftp to upload and maintain my websites (no git)
I was wondering if anyone could explain how I can transfer my files, databases, and domains to either AWS or Heroku.
I prefer the one that is easier and faster to migrate to.
Thanks.
If server/network management is not your strength, I would strongly advise against using AWS (even as big a proponent of AWS as I am). You absolutely must manage the servers yourselves, at least the configuration aspect (not the hardware aspect). In fact, you will find that you have to do things like set up security policies, identity access management, IP addresses, etc. that are not always that intuitive to one who is not used to working in a bit of an operations capacity.
You will also likely have to consider application architecture changes to work best with AWS services. Additionally, you will have to become accustomed to the AWS way of doings things (that starting and stopping server instances may make all your data go away and such).
If you are looking for a hands-off server approach, you might be better served looking at something like Slicehost/Rackspace.
I can't talk much to Heroku as I have only minimal experience prototyping on it. You can think of it more as an application platform. For simple applications that don't have unique traffic demands or architectural requirements, it seems a good solution for getting an application up and running with minimal server-related configuration. Again a legacy app will probably require some re-architecting to do things the Heroku way.
AWS are good but the support at Rackspace is far better and much more suited for someone like you. Rackspaces support is 24/7 and even on their online chat system you don't need to wait more than a few mins to speak to someone who actually knows what they are doing.
I have developed several websites on my local host for school. I can program database driven aspects of a webisite such as a blog on my own no problem. At school I used a MySQL DB which was hosted on a dedicated server, so when the server went down I could not have access to my data. I also have a mysql DB on my localhost but...my question is this: If i use the MySQL DB on my localhost, won't I only have access to the data when my computer is running so that my site can make server requests?
How can I set up any kind of DB for my site that is reliable and doesn't depend on my localhost to act as a DB Server?
I am now developing in .NET
Thanks. PS I don't have access to schools' server any more.
PPS I still don't have a site set up through a hosting provider...probalby going to go with godaddy
You'll need a server for that. A server will cost you on a monthly basis, I haven't heard of any free mysql servers, someone else may be able to help you with that.
Regular hosting providers supply PHP and MySQL server. I run my sites on Dreamhost (www.dreamhost.com)
It might also be worthwhile to look into Amazon EC2 : http://aws.amazon.com/ec2/
Also Amazon RDS for pure database only usage : http://aws.amazon.com/rds/
They provide a pay as you use service and the tier 1 service is free for the first year as I understand
There's no magic, you have to host your DB on a server that will run 24/7. Could be on the internet, it depends on the firewalls surrounding you.
The website will always depend on some sort of database server, why so worried that your database will be unreachable? Your webserver can go down also and will have the same consequences as the db.
Why don't you get some paid hosting? It is fairly cheap these days, for around 30dollar/year you will have some reliable hosting. When the DB will break down, it is not your responsibility.
If you don't want te be dependent of MySQL, you will need to use plain-text database that will be maintained by PHP or something.
You might consider running the MYSQL in i.e. a cloud provider, like Amazon EC2. It will certainly cost some money.