4 ms·

That sucks! But the real lesson should be that you do not expose your database on the internet (0.0.0.0 vs 127.0.0.1). That way it doesn’t matter if you leak yo

That sucks! But the real lesson should be that you do not expose your database on the internet (0.0.0.0 vs 127.0.0.1). That way it doesn’t matter if you leak your .env via your webserver. Never expose sensitive services.

ngranja19 7y ago
If I use 0.0.0.0 I'll still be able to access my DB remotely? sorry for the ignorance...
- terwey 7y ago
  You can setup an SSH tunnel to your remote machine. Some DB explorers offer this tunneling out of the box (e.g. Sequel Pro for Mac). Top hit on Google for how to setup a SSH tunnel for MySQL: https://linuxize.com/post/mysql-ssh-tunnel/ https://linuxize.com/post/mysql-ssh-tunnel/
  - ngranja19 7y ago
    Oh, but that is what I do, I set up an ssh tunnel, so I'll change it, thanks!
    - GauntletWizard 7y ago
      You should post again on what you're going to change, because i (at least) read that advice both ways, and I want to make sure you're reading it the way that was intended. If your database is open to 127.0.0.1/{8,24,32}, it is open only to the local host; that is the non-routable localhost address and it's not accessible to the internet. If your database is open to 0.0.0.0/0, it is open to the internet and anyone can attempt login. This is bad. Presumably you also still need a password, but never assume. Always have defense in depth - at least two things need to go wrong/be wrong before you're compromised.
mc3 7y ago
The real lesson is there are multiple lessons. Layered security and risk management. Back up automatically, don't expose database, don't expose configuration files, use tools to try and exploit your own site first, try to avoid passwords in files at all if there ways to do so such as credential stores, encrypt data at rest, no plaintext passwords. When one layer fails the next layer turns this from a catastrophe into a mere headache.

4 ms·

That sucks! But the real lesson should be that you do not expose your database on the internet (0.0.0.0 vs 127.0.0.1). That way it doesn’t matter if you leak yo

by michaelmcmillan 7y ago

ngranja19 7y ago
If I use 0.0.0.0 I'll still be able to access my DB remotely? sorry for the ignorance...
- terwey 7y ago
  You can setup an SSH tunnel to your remote machine. Some DB explorers offer this tunneling out of the box (e.g. Sequel Pro for Mac). Top hit on Google for how to setup a SSH tunnel for MySQL: https://linuxize.com/post/mysql-ssh-tunnel/ https://linuxize.com/post/mysql-ssh-tunnel/
  - ngranja19 7y ago
    Oh, but that is what I do, I set up an ssh tunnel, so I'll change it, thanks!
    - GauntletWizard 7y ago
      You should post again on what you're going to change, because i (at least) read that advice both ways, and I want to make sure you're reading it the way that was intended. If your database is open to 127.0.0.1/{8,24,32}, it is open only to the local host; that is the non-routable localhost address and it's not accessible to the internet. If your database is open to 0.0.0.0/0, it is open to the internet and anyone can attempt login. This is bad. Presumably you also still need a password, but never assume. Always have defense in depth - at least two things need to go wrong/be wrong before you're compromised.
mc3 7y ago
The real lesson is there are multiple lessons. Layered security and risk management. Back up automatically, don't expose database, don't expose configuration files, use tools to try and exploit your own site first, try to avoid passwords in files at all if there ways to do so such as credential stores, encrypt data at rest, no plaintext passwords. When one layer fails the next layer turns this from a catastrophe into a mere headache.