Do you allow remote MySQL access?

[SoftDux]

Hi,



I'm curious, do you allow remote MySQL access to your server(s)?

This could have an impact on your security and bandwidth usage, but a lot of clients also need to use it.



So, as matter of interest, who allows remote MySQL access, and what kind of problems have you run into so far?

Upto now we just move all clients who need remote MySQL access to a specific server that has MySQL ports open, but that server is getting full and I'm considering just opening the ports on all the servers instead. cPanel also has a utility where the client needs to add his IP to the "allow remote MySQL connections" list, so it does add some security, but it's still plain text (AFAIK), so it does open up a security hole nonetheless.



I suppose I could change the MySQL port, OR probably even port forward another port to the MySQL port for added security.



But has anyone really had any problems with an open MySQL server?



P.S. I know about phpMyAdmin, and how to block the port. This isn't a "how do I block the ports", or "how do I setup phpMyAdmin" question.

[d_t]

I block MySQL port from firewall for all except IPs from "Allow remote MySQL". In csf you can do this by adding the following query result to /etc/csf/csf.allow

mysql mysql -e "select Host,User from user where Host!='localhost' group by Host;" | awk {'print "tcp:in:d=3306:s=" $1 "\t# " $2'} | sed "s/\%//g" | egrep "[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}" | grep -v "127.0.0.1" | sort | uniq