Encrypting webserver-2-MySQL traffic? 3

[DPisarev]

Hi, all,

I've got quite a few questions, so I'll number them to make sure none of them get lost. I've been looking for answers to these questions on and off for about a month now but couldn't find any satisfactory information through seach engines or various forum archives, so I guess I'll check with live experts...

1) From what I gather, one rarely encrypts traffic between a MySQL database and the webserver in practice, is that right? For instance, there's very little discussion of such encryption even on this forum... 2) Is this state of things specific to the MySQL community only or is this also the case with other DB systems?

I know about the optional OpenSSL extension for MySQL but it's a huge pain to use in its present form: you need to compile the sourcecode and then install it as a module into MySQL, and I'm just getting into MySQL administration... 3) I wonder if there are easier ways to achieve the goal of encryption than using OpenSSL?

4) I am also aware of the existence of STunnel but, by the looks of it, it also requires a slightly lengthy set-up for someone who's never dealt with this app. before, no? Besides, I'm not too sure how good and efficient an alternative STunnel will turn out to be... What I want is to just get on with programming the logic of my 3-tier application and I'll appreciate any advice on how to set up the underlying groundwork as quickly as possible.

One more question, if I may. Suppose my MySQL-bound traffic passes through STunnel. Suppose also that STunnel and MySQL are installed on the same machine. 5) Am I guaranteed that the unencrypted STunnel-to-MySQL traffic won't leave the machine? 6) What if STunnel and MySQL are located on different machines but within the same LAN -- will the traffic between them stay inside the LAN for sure?

I know I may be sounding a bit paranoid about all of this but we intend to put quite sensitive information into our DB and communications with it must be firmly secure.

Now, it just may be that I'm thinking along too narrow lines and am not aware of some good alternatives. 7) In this case, can anyone suggest whether I'd be better off, for instance, using another DB system for my needs? 8) Any other fundamental suggestions?

My goal, as I mentioned, is to set up the architecture as quickly and painlessly as possible and get on to programming the business logic.

Thanks in advance for your answers!

 

[ericbrunson]

If your webserver and the database are on the same server, encrypting the communications between the two is unnecessary. Anything that could read the unencrypted domain socket traffic on the system would have already subverted the system to the point that your STunnel could be backdoored.

 

[DPisarev]

Thanks, Eric, I suppose this answers my question #5. I only wonder if there's any *guarantee* on the TCP/IP, hardware or some other level that says that traffic between different ports on the same machine won't leave the box?

I'm not sure if the second part of your answer referred to my question #5 as well, or to #6.

Can you or anyone else throw in any ideas on the other questions?

Thanks,
D. P.

 

[DPisarev]

Can anyone provide any more answers?

Thanks in advance,
Dmitri.

 

[cdlvj]

Have you seen this part of mysql document?

http://dev.mysql.com/doc/mysql/en/Secure_basics.html

 

[DPisarev]

Cdlvj,

Yes, I've seen that page. It talks about how to install OpenSSL -- something that is a pain in its present form, since OpenSSL also needs to be compiled first (cf. my paragraph #3)...

D. P.

 

[cdlvj]

There are user comments on implementing STunnel, did you see that.

 

[DPisarev]

Cdlvj,

I did. They give a procedure for setting up STunnel but don't answer the more philosophical questions I had in mind (#5 & #6)...

D.P.

 

[lgarner]

5- The server won't put traffic on the lan unless that's where it needs to go. Traffic to 127.0.0.1 won't hit a LAN interface.

6- Depends on your routing. If by "LAN" you mean a single IP subnet, then the router will block anything that's destined for another segment.

 

[ingresman]

Two things.
If the mysql and php are on the same machine great, but if you want to scale out in the future (and hence have php on a different machine from at least one remote machine) make sure what you do now doesn't compromise your situation.
Second. could you encrypt only the sensitive stuff ?. This might mean, for example, converting int's into char but if you access the data through a nice little class it shouldn't be too hard. It also keeps your data private should someone decide to use a query tool with ODBC to have a peek inside.

 

[ingresman]

Just thought, I'm not a TCP person but could you get hardware encryption between machines or could you use IPSEC?

 

[DPisarev]

Ingresman,

Interesting, but seems to be even more trouble than STunnel...

Hmm. I wonder if there are any good (=free+functional) alternatives to MySQL that don't require you to compile anything to get traffic encryption and for which there are hopefully some JDBC drivers?

D. P.

 

[ingresman]

CA have released Ingres into opensource, that used to do encryption i recall.

 

[DPisarev]

Does anyone have an opinion on embedded databases? Since they reside in the application server itself, it doesn't appear that traffic encryption issues are applicable here at all, no?

D. P.

 

[ingresman]

ok as long as they perform ok, but do beware that you will not be able to scale your application to more than one server if you go that route.

 

[DPisarev]

Ingresman,

Yeah, this application is for a small business, so scalability is not an issue.

Thanks, all, for your insightful comments!
D. P.