Re:PhpMyAdmin Turns 15
by snowwrestler on Monday September 09, 2013 @05:59PM
(#6356551)
The most secure setup for administrative services is to whitelist their ports by IP address. For example port 22 (SSH) on our servers can only be hit by known-good IP addresses. You can do the same for MySQL's port, or use an SSH tunnel to hit MySQL through localhost.
[ Parent
| on HN ]
Re:PhpMyAdmin Turns 15
by gonnakillme on Monday September 09, 2013 @09:44PM
(#6357544)
Restricting SSH to "known-good" IP addresses is less flexible and less secure than public key authentication.
(Restricting mysql access to localhost and using an SSH tunnel is fine practice, AFAIK.)
Re:PhpMyAdmin Turns 15
by snowwrestler on Tuesday September 10, 2013 @01:19PM
(#6361439)
It is less flexible, but it is more secure than using public key authentication by itself (public key auth can be used in conjunction with an IP whitelist).
Re:PhpMyAdmin Turns 15
by gonnakillme on Tuesday September 10, 2013 @02:11PM
(#6361824)
I'm not sure an IP whitelist gives you anything -- it provides a handy mechanism for escalating privileges, both for intrusions on a machine at the "known-good" IP and for unintended network access in general.
Re:PhpMyAdmin Turns 15
by superuser2 on Tuesday September 10, 2013 @10:51PM
(#6365203)
Um. No. Bouncing traffic through one device out of probably many at your house (when's the last time you updated the firmware on your TV? Your router?) is a lot more feasible than breaking public key encryption.