deny mysql access outside the firewall

[anyweb]

what if someone hacked your mysql via a mysql injection vulnerability and wanted to use it to connect to you in order to upload/download tools to further compromise a system

 

well, if you block if from communicating outside the firewall (ie: to the internet) then you are making that more difficult for the attacker to do so

 

thoughts about this ?

 

Code:

iptables -A OUTPUT -p tcp --sport 3306 -j DROP

 

cheers

 

anyweb

[znx]

what if someone hacked your mysql via a mysql injection vulnerability and wanted to use it to connect to you in order to upload/download tools to further compromise a system 

well, if you block if from communicating outside the firewall (ie: to the internet) then you are making that more difficult for the attacker to do so

 

thoughts about this ?

 

Code:

iptables -A OUTPUT -p tcp --sport 3306 -j DROP

<div>


</div>

 

my thought is that most sql injection will be via a script on a site (say php) and will add the user/pass details into what ever utility the script is a part of..

 

for instance.. sql injection to add a user/pass to this board as admin (of course). restricting the mysql server from external access won't cure you from that (although i do agree with the external block) and then the user can damage the data here in the boards. and to me thats far more important, the server can be rebuild from scratch, the data can't.

 

see my bit on backing up a mysql database and place it somewhere safe.

 

personally my believe is that all points that add/insert data into mysql should be secured, ie stop the injection from occuring. i would also say move your mysql server onto another box (if you are going to production scale). this will allow you to setup better rulesets and permissions unique to the mysql database (rather than the db and the web server).

 

look after your code, look after your ports.

[anyweb]

and to me thats far more important, the server can be rebuild from scratch, the data can't.

 

yeah well i'm taking care of that already, all the mysql data is backed up in full weekly and ftp'd off the server, same goes for the websites, all are automatically backed up.

 

just looking at ways of keeping the bad guys out

 

cheers

 

anyweb

[hijinks]

one of the best ways to stop sql attacks is use a apache module called mod_security

 

[/url][url=http://www.modsecurity.org/]http://www.modsecurity.org/