Page 1 of 2 12 LastLast
Results 1 to 10 of 11

Thread: MySQL security issue

  1. #1
    Join Date
    May 2013
    Beans
    7

    MySQL security issue

    I have MySQL 5.5.31 running on Ubuntu server 12.04.1. I really don't know much about MySQL and, I managed to set it up so the data base can only be accessed from a computer with a specific ip address.

    I would like to set it up to be accessed from any computer on my network. I have been trying to figure out where I went wrong and have hit a brick wall.
    I can post which ever configuration files are needed

    Thanks in advance
    Last edited by remeny; May 26th, 2013 at 09:45 PM.

  2. #2
    Join Date
    Nov 2008
    Location
    Kingdom of cookies
    Beans
    Hidden!
    Distro
    Ubuntu Development Release

    Re: MySQL security issue

    Quote Originally Posted by remeny View Post
    I have MySQL 5.5.31 running on Ubuntu server 12.04.1. I really don't know much about MySQL and, I managed to set it up so the data base can only be accessed from a computer with a specific ip address.

    I would like to set it up to be accessed from any computer on my network. I have been trying to figure out where I went wrong and have hit a brick wall.
    I can post which ever configuration files are needed

    Thanks in advance
    Use iptables to make it so that only a specific network is allowed to access it. - see below example where 10.0.0.0/8 is my network. This restricts all data incoming to the server so that only those on the network can send incoming data
    Run the below (warning, it will remove all your current iptables rules)
    Code:
    sudo iptables -F
    sudo iptables -A INPUT -m tcp -p tcp -s 10.0.0.0/8 -d <ip of your server here> -j ACCEPT
    sudo  iptables -A INPUT -m tcp -p tcp -d <ip of your server here> -j REJECT
    sudo iptables-save > /path/to/iptables/rules
    Replace /path/to/iptables/rules with an appropriate place to save the iptables rules

    Now, to set the rules, just run
    Code:
    sudo iptables-restore < /path/to/iptables/rules
    To make it apply on startup (If youve already done this, remove it)
    Code:
    sudo nano /etc/network/if-up.d/iptables
    Enter in the below
    Code:
    #!/bin/bash
    sudo iptables-restore < /path/to/iptables/rules
    Control +X to save.

    Run
    Code:
    sudo chmod +x /etc/network/if-up.d/iptables
    to enable it.

    To add more rules, just run iptables-restore, add the rules to iptables like above, and use iptables-save like above.
    Last edited by sandyd; May 26th, 2013 at 07:16 AM.
    Ubuntu Forums Moderation Staff || SandyDNET
    Twitter: @CatchesAStar | Last.fm
    Ubuntu Membership via Forum Contributions

  3. #3
    Join Date
    May 2013
    Beans
    7

    Re: MySQL security issue

    I think I see what you are getting at.
    Does /etc/bash_completion.d/ sound like the place for the iptable rules?
    Also I'm getting
    "iptables v1.4.12: Couldn't load target `DENY':No such file or directory" when that line runs.
    Any Ideas?

  4. #4
    Join Date
    Nov 2008
    Location
    Kingdom of cookies
    Beans
    Hidden!
    Distro
    Ubuntu Development Release

    Re: MySQL security issue

    try again (updated)
    make sure you are following all the direction to point
    Last edited by sandyd; May 26th, 2013 at 05:23 AM.
    Ubuntu Forums Moderation Staff || SandyDNET
    Twitter: @CatchesAStar | Last.fm
    Ubuntu Membership via Forum Contributions

  5. #5
    Join Date
    May 2013
    Beans
    7

    Re: MySQL security issue

    I cant ssh into the server any more, Ill get back as soon as I get a monitor on it. I guess I shouldn't mess with iptables while using ssh

  6. #6
    Join Date
    Nov 2008
    Location
    Kingdom of cookies
    Beans
    Hidden!
    Distro
    Ubuntu Development Release

    Re: MySQL security issue

    You should make sure that the subnet in your iptables is correct (mine is 10.0.0.0/8), in addition, you will only be able to ssh in from that network
    Ubuntu Forums Moderation Staff || SandyDNET
    Twitter: @CatchesAStar | Last.fm
    Ubuntu Membership via Forum Contributions

  7. #7
    Join Date
    Oct 2009
    Beans
    Hidden!
    Distro
    Ubuntu 12.04 Precise Pangolin

    Re: MySQL security issue

    Quote Originally Posted by remeny View Post
    I cant ssh into the server any more, Ill get back as soon as I get a monitor on it. I guess I shouldn't mess with iptables while using ssh
    If you are going to mess with iptables remotely, use iptables-apply instead of iptables-restore.

    You will need to add any existing firewall rules to the script sandyd provided or add a similar line to your existing firewall rules.
    Come to #ubuntuforums! We have cookies! | Basic Ubuntu Security Guide

    Tomorrow's an illusion and yesterday's a dream, today is a solution...

  8. #8
    Join Date
    May 2013
    Beans
    7

    Re: MySQL security issue

    I'm thinking the issue is with MySQL. I can SSH into the server and use the database that way. I can Also connect using MySQL workbench. I can't, however get KMy money to connect unless I am at a specific IP address. I can't seem to find any MySQL error logs unfortunately.

  9. #9
    Join Date
    Oct 2009
    Beans
    Hidden!
    Distro
    Ubuntu 12.04 Precise Pangolin

    Re: MySQL security issue

    Are you sure mysql is listening on the external interface and not lo?

    It should show up as 0.0.0.0 in netstat.
    Come to #ubuntuforums! We have cookies! | Basic Ubuntu Security Guide

    Tomorrow's an illusion and yesterday's a dream, today is a solution...

  10. #10
    Join Date
    May 2013
    Beans
    7

    Re: MySQL security issue

    How does this look to you


    Code:
    Active Internet connections (w/o servers)
    Proto Recv-Q Send-Q Local Address           Foreign Address         State      
    tcp        0    160 192.168.1.11:ssh        192.168.1.8:35161       ESTABLISHED
    tcp        0      0 192.168.1.:microsoft-ds 192.168.1.8:33421       ESTABLISHED
    udp        0      0 localhost:41373         localhost:41373         ESTABLISHED
    Active UNIX domain sockets (w/o servers)
    Proto RefCnt Flags       Type       State         I-Node   Path
    unix  8      [ ]         DGRAM                    8776     /dev/log
    unix  3      [ ]         STREAM     CONNECTED     10139    
    unix  3      [ ]         STREAM     CONNECTED     10138    
    unix  2      [ ]         DGRAM                    10463    
    unix  3      [ ]         STREAM     CONNECTED     10458    /var/run/samba/winbindd_privileged/pipe
    unix  3      [ ]         STREAM     CONNECTED     10056    
    unix  3      [ ]         STREAM     CONNECTED     10436    
    unix  3      [ ]         STREAM     CONNECTED     10435    
    unix  3      [ ]         STREAM     CONNECTED     10434

Page 1 of 2 12 LastLast

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •