How to secure a MySQL connection over network?

Question

I'm running Tomcat 7/MySQL 5.6 on Centos 6. It's time to separate the database to another server. What is the best approach to securing the connection between Tomcat and the backend MySQL server. It's Virtualized and I don't want to run the connection open over a shared network.

I'm thinking tunneling through ssh. SSL seems a lot of work. But what's the "recommended" approach?

Answer 1

You're right to be careful about sending traffic over an open network. The MySQL protocol by default is not encrypted at all, so if someone can capture packets on your network, then they can see all your data.

I prefer using either an ssh tunnel or a vpn connection. I just find it easier to configure.

My colleague Ernie Souhrada at Percona posted a couple of really good blog articles about the efficiency of using an ssh tunnel versus using MySQL client options to connect via SSL and bear the overhead of handshaking on every connection.

• http://www.mysqlperformanceblog.com/2013/10/10/mysql-ssl-performance-overhead/
• http://www.mysqlperformanceblog.com/2013/11/18/mysql-encryption-performance-revisited/

The performance impact of SSL handshake that Ernie reports won't be quite a much of an issue for a Tomcat environment, since you would typically have a connection pool, and therefore new connections would be made less frequently.