Best Practices for Securing Remote Access to MySQL
Jul 12, 2025 am 02:25 AMThe security of remote access to MySQL is guaranteed by restricting permissions, encrypting communications, and regular audits. 1. Set a strong password and enable SSL encryption. Force --ssl-mode=REQUIRED when connecting to the client; 2. Restrict access to IP and user rights, create a dedicated account and grant the minimum necessary permissions, and disable root remote login; 3. Configure firewall rules, close unnecessary ports, and use springboard machines or SSH tunnels to enhance access control; 4. Enable logging and regularly audit connection behavior, use monitoring tools to detect abnormal activities in a timely manner, and ensure database security.
Remote access to MySQL is part of the daily work of many developers and system administrators, but if not configured correctly, it can become the source of security vulnerabilities. The most direct point is that the security of remote access to MySQL depends on how you restrict access, encrypt communications, and regularly audit connection behavior .

Below are some practical suggestions that can help you do this more securely.

1. Use a strong password and enable SSL encryption
MySQL uses plain text to transmit data by default. If someone monitors network traffic in the middle, the account password may be intercepted. so:
- Set complex passwords to avoid using common vocabulary or default account names.
- Enable SSL connection , enable
ssl
in the MySQL configuration file and require the client to force it. - When connecting to the client, add
--ssl-mode=REQUIRED
parameter to ensure that the connection does not go in plain text.
Although SSL is not omnipotent, it can at least add a layer of protection to the transport layer to prevent "running naked".

2. Restrict access to IP and user permissions
For convenience, many people directly open %
permissions to a certain user, that is, allow access from any IP, which is actually very dangerous.
- Only specific IP or IP segments are allowed to access . For example, if you work in the office, you will bind the company's export IP; if it is a dynamic IP, you can consider using a springboard machine or an intranet penetration tool.
- Do not use the root user to log in remotely , create a dedicated account, and grant only the minimum necessary permissions (such as read-only accounts cannot be written).
- Deleting anonymous users and testing databases is often the first step for an attacker.
For example:
CREATE USER 'remote_user'@'192.168.1.100' IDENTIFIED BY 'StrongPass!123'; GRANT SELECT, INSERT ON mydb.* TO 'remote_user'@'192.168.1.100';
The advantage of this is that even if the account is leaked, the scope of impact is limited.
3. Isolate with firewalls and services
In addition to the configuration of MySQL itself, security policies at the operating system level are also critical:
- Close unnecessary ports . MySQL defaults to 3306, ensuring that only this port is exposed to the outside world.
- Configure firewall rules on the server, such as iptables or ufw, to allow only specific IP or subnet access.
- If conditions permit, place the database in a private network and access it through a springboard (Jump Host) or VPN.
For example, you can do this:
- Setting up a firewall allows only IPs from your development machine to access port 3306
- Use SSH tunnel to connect to MySQL, so that even if the 3306 is not open to the public, it can operate remotely
Although this approach is a little bit troublesome, it greatly reduces the risk of being scanned.
4. Regular audit logs and connection records
Many times, security problems do not break out suddenly, but accumulate slowly. so:
- Enable MySQL's slow query log, error log, and general query log to see if there are any abnormal connection attempts.
- Check the current connection regularly and use
SHOW PROCESSLIST;
see if someone has occupied resources for a long time. - Use monitoring tools such as Prometheus Grafana or Zabbix to observe database status in real time.
If you find that a strange IP fails to frequently try to connect, it is likely that it is brute-force cracking. At this time, you should update your password or block the IP immediately.
Basically that's it. Remote access to MySQL itself is not difficult, but to be truly secure, you need to start from multiple levels, not just changing a few configurations.
The above is the detailed content of Best Practices for Securing Remote Access to MySQL. For more information, please follow other related articles on the PHP Chinese website!

Hot AI Tools

Undress AI Tool
Undress images for free

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics

To reset the root password of MySQL, please follow the following steps: 1. Stop the MySQL server, use sudosystemctlstopmysql or sudosystemctlstopmysqld; 2. Start MySQL in --skip-grant-tables mode, execute sudomysqld-skip-grant-tables&; 3. Log in to MySQL and execute the corresponding SQL command to modify the password according to the version, such as FLUSHPRIVILEGES;ALTERUSER'root'@'localhost'IDENTIFIEDBY'your_new

When handling NULL values ??in MySQL, please note: 1. When designing the table, the key fields are set to NOTNULL, and optional fields are allowed NULL; 2. ISNULL or ISNOTNULL must be used with = or !=; 3. IFNULL or COALESCE functions can be used to replace the display default values; 4. Be cautious when using NULL values ??directly when inserting or updating, and pay attention to the data source and ORM framework processing methods. NULL represents an unknown value and does not equal any value, including itself. Therefore, be careful when querying, counting, and connecting tables to avoid missing data or logical errors. Rational use of functions and constraints can effectively reduce interference caused by NULL.

mysqldump is a common tool for performing logical backups of MySQL databases. It generates SQL files containing CREATE and INSERT statements to rebuild the database. 1. It does not back up the original file, but converts the database structure and content into portable SQL commands; 2. It is suitable for small databases or selective recovery, and is not suitable for fast recovery of TB-level data; 3. Common options include --single-transaction, --databases, --all-databases, --routines, etc.; 4. Use mysql command to import during recovery, and can turn off foreign key checks to improve speed; 5. It is recommended to test backup regularly, use compression, and automatic adjustment.

Turn on MySQL slow query logs and analyze locationable performance issues. 1. Edit the configuration file or dynamically set slow_query_log and long_query_time; 2. The log contains key fields such as Query_time, Lock_time, Rows_examined to assist in judging efficiency bottlenecks; 3. Use mysqldumpslow or pt-query-digest tools to efficiently analyze logs; 4. Optimization suggestions include adding indexes, avoiding SELECT*, splitting complex queries, etc. For example, adding an index to user_id can significantly reduce the number of scanned rows and improve query efficiency.

TosecurelyconnecttoaremoteMySQLserver,useSSHtunneling,configureMySQLforremoteaccess,setfirewallrules,andconsiderSSLencryption.First,establishanSSHtunnelwithssh-L3307:localhost:3306user@remote-server-Nandconnectviamysql-h127.0.0.1-P3307.Second,editMyS

GROUPBY is used to group data by field and perform aggregation operations, and HAVING is used to filter the results after grouping. For example, using GROUPBYcustomer_id can calculate the total consumption amount of each customer; using HAVING can filter out customers with a total consumption of more than 1,000. The non-aggregated fields after SELECT must appear in GROUPBY, and HAVING can be conditionally filtered using an alias or original expressions. Common techniques include counting the number of each group, grouping multiple fields, and filtering with multiple conditions.

MySQL transactions and lock mechanisms are key to concurrent control and performance tuning. 1. When using transactions, be sure to explicitly turn on and keep the transactions short to avoid resource occupation and undolog bloating due to long transactions; 2. Locking operations include shared locks and exclusive locks, SELECT...FORUPDATE plus X locks, SELECT...LOCKINSHAREMODE plus S locks, write operations automatically locks, and indexes should be used to reduce the lock granularity; 3. The isolation level is repetitively readable by default, suitable for most scenarios, and modifications should be cautious; 4. Deadlock inspection can analyze the details of the latest deadlock through the SHOWENGINEINNODBSTATUS command, and the optimization methods include unified execution order, increase indexes, and introduce queue systems.

MySQL paging is commonly implemented using LIMIT and OFFSET, but its performance is poor under large data volume. 1. LIMIT controls the number of each page, OFFSET controls the starting position, and the syntax is LIMITNOFFSETM; 2. Performance problems are caused by excessive records and discarding OFFSET scans, resulting in low efficiency; 3. Optimization suggestions include using cursor paging, index acceleration, and lazy loading; 4. Cursor paging locates the starting point of the next page through the unique value of the last record of the previous page, avoiding OFFSET, which is suitable for "next page" operation, and is not suitable for random jumps.
