From owner-freebsd-security@FreeBSD.ORG Tue Jan 22 15:08:23 2008 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id AC30216A417 for ; Tue, 22 Jan 2008 15:08:23 +0000 (UTC) (envelope-from jordi.espasa@opengea.org) Received: from mail.opengea.org (mail.opengea.org [85.48.253.234]) by mx1.freebsd.org (Postfix) with ESMTP id 4B3F413C442 for ; Tue, 22 Jan 2008 15:08:23 +0000 (UTC) (envelope-from jordi.espasa@opengea.org) Received: from localhost (tartarus [127.0.0.1]) by mail.opengea.org (Opengea.org Project MailServer) with ESMTP id 68FA2D50039 for ; Tue, 22 Jan 2008 16:11:55 +0100 (CET) X-Virus-Scanned: amavisd-new at opengea.org Received: from mail.opengea.org ([127.0.0.1]) by localhost (mail.opengea.org [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id WrzeUUMRKaCA for ; Tue, 22 Jan 2008 16:11:55 +0100 (CET) Received: from jespasac.cdmon.com (62.Red-217-126-43.staticIP.rima-tde.net [217.126.43.62]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) (Authenticated sender: jordi.espasa@opengea.org) by mail.opengea.org (Opengea.org Project MailServer) with ESMTP id 10458D50033 for ; Tue, 22 Jan 2008 16:11:54 +0100 (CET) Message-ID: <479606E4.2070607@opengea.org> Date: Tue, 22 Jan 2008 16:08:20 +0100 From: Jordi Espasa Clofent User-Agent: Thunderbird 2.0.0.9 (X11/20071219) MIME-Version: 1.0 To: freebsd-security@freebsd.org References: <47946AD3.2020601@opengea.org> <47953894.8020906@netoyen.net> In-Reply-To: <47953894.8020906@netoyen.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: denyhosts-like app for MySQLd? X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Jan 2008 15:08:23 -0000 > why do you open your mysql port to the world? > > if you want to let users in from any place, then an ssh tunnel is safer > (yes, works even on windows, using putty or whatever. and a user who > finds this difficult shouldn't be able to run sql commands!). I completely agree with you; the problem is always the same: the decisions are taken by non-technical staff in a lot of times. I've proposed a ssh tunnels for MySQL remote connections... but it means "so hard" for final customers.... > If this is too much, at least use a different port to reduce the noise > (This won't add security, but will somehow limit exposure).scribe@freebsd.org" Of course. -- Thanks, Jordi Espasa Clofent