From owner-freebsd-security@FreeBSD.ORG Wed Jan 23 01:59:25 2008 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 88D9516A419 for ; Wed, 23 Jan 2008 01:59:25 +0000 (UTC) (envelope-from mouss@netoyen.net) Received: from balou.adapsec.com (balou.adapsec.com [91.121.103.130]) by mx1.freebsd.org (Postfix) with ESMTP id 4E3A113C459 for ; Wed, 23 Jan 2008 01:59:25 +0000 (UTC) (envelope-from mouss@netoyen.net) X-Virus-Scanned: amavisd-new at netoyen.net Received: from [192.168.1.65] (ouzoud.netoyen.net [82.239.111.75]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) (Authenticated sender: mouss@netoyen.net) by balou.adapsec.com (Postfix) with ESMTPSA id 0552B4BFC57E for ; Wed, 23 Jan 2008 02:59:49 +0100 (CET) Message-ID: <47969F79.30500@netoyen.net> Date: Wed, 23 Jan 2008 02:59:21 +0100 From: mouss User-Agent: Thunderbird 2.0.0.6 (Windows/20070728) MIME-Version: 1.0 CC: freebsd-security@freebsd.org References: <47946AD3.2020601@opengea.org> <47953894.8020906@netoyen.net> <479606E4.2070607@opengea.org> In-Reply-To: <479606E4.2070607@opengea.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: denyhosts-like app for MySQLd? X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Jan 2008 01:59:25 -0000 Jordi Espasa Clofent wrote: >> why do you open your mysql port to the world? >> >> if you want to let users in from any place, then an ssh tunnel is >> safer (yes, works even on windows, using putty or whatever. and a >> user who finds this difficult shouldn't be able to run sql commands!). > > I completely agree with you; the problem is always the same: the > decisions are taken by non-technical staff in a lot of times. > I've proposed a ssh tunnels for MySQL remote connections... but it > means "so hard" for final customers.... I know it's not easy. but depending on your customers, you may have some chances! - if they can buy a license for sqlyog, it will support sql tunnels directly (otherwise, you need an external tunnel, which you can setup with putty or whatever). - it should not be hard to use an ssl tunnel (stunnel or whatever) - you might be able to ask what IPs are supposed to get there. even if it's not precise, this could reduce risks by only allowing few networks. > >> If this is too much, at least use a different port to reduce the >> noise (This won't add security, but will somehow limit >> exposure).scribe@freebsd.org" > > Of course. > This is generally consider "security by obscurity". I don't think so. This is making it harder for an attacker to get there without being noticed. while a script kiddie can run his script to try a stand port, if he wants to get inside a "local" port, he'll need to try many ports and for each port try the right protocol. This gives us time to get him.