Comments on: Secure mysql replication between colos over an ssh tunnel

By: PHP Programming India

PHP Programming India — Wed, 15 Oct 2008 11:49:05 +0000

Very informative. Thanks for the information!

Raj Malhotra
PHP Programming India

By: jaisen

jaisen — Mon, 13 Oct 2008 20:53:35 +0000

@Tom, Thanks for pointing that out - I’ll add that option to the post. While this addresses #1 and #3, there’s still security to be gained by not having mysql listening publicly.

I’m assuming that there’s some ssh entry point to the machine (if not directly through a firewall). So having ssh open on some port is a given. The more applications you have listening publicly the more chances you have for being exploited. Note, I’m not saying Apache is (or isn’t) more secure than MySql, but the more entry points the more likely something can happen.

Personally, I prefer ports 80, 443 and a non standard port for ssh.

By: Tom

Tom — Mon, 13 Oct 2008 20:04:08 +0000

Built in MySQL encryption: http://dev.mysql.com/doc/refman/5.0/en/secure-using-ssl.html

Having port 3306 open is probably just as secure or insecure as having a random ssh port open somewhere.

By: jaisen

jaisen — Sat, 11 Oct 2008 05:46:27 +0000

@Brandon, Thanks for the tips. I’ll definitely check out the two posts you mentioned (and subscribe via RSS).

By: jaisen

jaisen — Sat, 11 Oct 2008 05:45:25 +0000

@Tom, not sure what built in encryption support you’re referring to. Even if MySql did have some sort of encryption support this method still allows you to keep MySql from listening publicly on port 3306.

By: Tom

Tom — Sat, 11 Oct 2008 01:30:53 +0000

Or, you could just use MySQL’s built in encryption support…

What is the point of this?

By: Brandon Checketts

Brandon Checketts — Sat, 11 Oct 2008 00:32:30 +0000

Hi. Glad that you find my instructions helpful. I have been running a server like this with tunnels to 3 other servers for several months now and it works very well.

The only thing I have noticed, is that if the connection between the server goes down for a while, then there can get to be multiple ‘check_tunnel’ scripts running that have to be killed manually. Other than that, I’ve had the connection between the servers die multiple times, and replication always starts right back up.

You might also be interested in the script I created to Monitor the replication to ensure that it doesn’t get behind.

Also, you’ll want to Enable replication compression between those servers to minimize the bandwidth used.