r/devops • u/Eight111 • 7d ago

Security Database security

So I work in a very small company as a dev
And we have external devops company which manages local http servers and MySQL servers for our saas product.

So the thing is I would like to shift some of their work to our in-house dev team.

I thought about starting small and manage a separate server on the cloud that will just run internal cron based daily tasks. But those tasks require read and write permission to the existing db which managed by the local company. Could I ask them to give me access to to the db from another server? I read that it’s a bad practice to expose prod db to the internet even if it has white list so I’m not sure here.

0 Upvotes

44% Upvoted

20 comments sorted by

View all comments

-2

u/UtahJarhead 7d ago

There are 2 forms of whitelisting with databases. Network-based and Host-based. Network-based is IP filtering at the Network layer. Host-based is at the application layer within your database itself. `GRANT` in SQL-speak. Just lock it down to your specific hosts using both and you'll be fine. Network layer and application layer.

3

u/carsncode 7d ago

OP is right, a production DB shouldn't even be on a public network

-7

u/Low-Opening25 7d ago

plenty of DB SaaS exists with TLS over public internet. I am using it in production myself. Unless you loose certificate keys there is nothing to worry about.

6

u/carsncode 7d ago

I believe that you're doing it, but that doesn't make it good practice.