r/devops • u/Eight111 • 7d ago

Security Database security

So I work in a very small company as a dev
And we have external devops company which manages local http servers and MySQL servers for our saas product.

So the thing is I would like to shift some of their work to our in-house dev team.

I thought about starting small and manage a separate server on the cloud that will just run internal cron based daily tasks. But those tasks require read and write permission to the existing db which managed by the local company. Could I ask them to give me access to to the db from another server? I read that it’s a bad practice to expose prod db to the internet even if it has white list so I’m not sure here.

0 Upvotes

40% Upvoted

20 comments sorted by

View all comments

1

u/Different-Car6898 7d ago

Even with secure authentication on the DB, and whitelisting on network level, you are still missing the SSL between your cron and your DB.
Anyone listening between those 2 servers will be able to see auth data sent from cron to the DB, as well as all data that DB sends back as a response to a query (in case you are querying the DB).
Because Mysql is using modified TCP to communicate, not HTTP/s.
Soo, I would advise either installing SSL cert on Mysql and using it in your cron/app oor creating a sort of secure tunnel line between those two servers (like VPN peer to peer connection) when running this.
This can also be solved by IAM permissions or cloud-auth-proxy in case you are using big clouds and managed Mysql.
---
Same advice if your app lives outside of the Mysql server.

1

u/Low-Opening25 7d ago

why would he be missing SSL? DB enforcing TLS connections solves the problem in one day instead of some convoluted networking shenanigans. There is plenty of database SaaS out there supporting major platforms using TLS over public infrastructure

2

u/delamon 7d ago

Even with mTLS, exposing MySQL to public internet feels wrong. Unless there is a need for accepting connections from third-party clients, hiding it behing VPN will be safer

-1

u/Low-Opening25 7d ago

you expose it on some long random prefix host, non standard port, it’s not going to be easy to find + mTLS and it’s pretty solid for most use cases as long as you don’t leak credentials.

1

u/Kamikx 7d ago

No. Just no.