With the new VLAN feature and "Private-Ips" do we need to have an SSL/TLS connection to a private database server?
Hello all,
I am new to setting up servers(and setting up SSL), so I apologize for any questions that are very basic, as all of the little bits are overwhelming to make sure everything is done correctly.
I am trying to setup my web-server as well as the additional pieces of object and database servers. I started doing some research into SSLs and LetsEncrypt, and from what I'm seeing today, it looks like Lets-Encrypt requires an actual Domain Name, and doesn't work with "IP-Addresses." I haven't really found much information on how one can setup these auxiliary servers with SSL, but I'm assuming it is similar to setting up the main web-server, and it's just that Lets-Encrypt itself doesn't work with IPs? Would I need another vendor then, or possibly signing my own cert, is that preferred for private servers/own-use-servers?
Besides this, I was thinking about the new VLAN Feature and Private IPs. From what I see the VLAN feature connects 2 linodes together, and it mentions "Securely transmit sensitive data across your private VLAN." I assume this is all I would need then, but this is also under the assumption that the connection between my linodes is indeed private and that non of the information can leak outside of this "VLAN?"
Overall, I am looking to have a private database that I would like to only be accessed via my web-server on the backend, and it wont be accessed publicly; however I do have an IDE that I normally connect to databases when I'm doing work or testing, so I'm not sure if I would ever need to connect in to this database server, so that might change what I need. It also might be better, now that I think about it, to possibly have a separate "Test Database" Server that I could connect to, that wouldn't affect the other Database server. I'm not sure if it makes sense to have 2 separate database servers, or 2 separate databases on the same server. To me it makes sense to have just everything on the same server with SSL, instead of setting up one server with and one without, but I'm very curious to see what others think.
Overall I'm a bit confused about what the best course of action is to protect these Database servers.
Thank you for any advice/help, I really appreciate it!
1 Reply
Hi @RedFlame12951,
it's just that Lets-Encrypt itself doesn't work with IPs
No, SSL certificates are all about verifying that the host you are connecting to is the host you think it is. All SSL certificates work on the basis of a “common name” which is nearly always the DNS hostname you are connecting to - be it HTTP, SMTP, MySQL etc.
Besides this, I was thinking about the new VLAN Feature and Private IPs.
Private IPs allow any Linode in the same DC (also with a private IP) to theoretically access your Linode. However I’m sure Linode have stated they employ MAC filtering to ensure Linodes in different accounts cannot access each other, but I don’t know how true or secure that is.
Equally I’m not sure how protected the traffic is - so if you don’t use SSL, whether that traffic can be sniffed by other Linodes on the private network.
VLANs on the other hand give you a truly segregated network that only allows the Linodes connected to it to communicate, so it is inherently more secure.
It also might be better, now that I think about it, to possibly have a separate "Test Database" Server that I could connect to, that wouldn't affect the other Database server.
This kinda depends on how rigid you need to be security-wise. I’ve had audits previously that insist on the dev/test/QA environments being physically separate to production, to prevent a flaw in your test app being used to access production data.
My advice would be to ensure your database service only listens on the “internal IP” (either private and/or VLAN) and is not bound to all interfaces (the “bind-address” property in MySQL) and employ a local firewall to ensure only your Linodes can access it.
If your data is sensitive enough and you’re worried about it being sniffed, use a VLAN and SSL - set up a hostname on your domain for each DB server with its private/VLAN IP and grab a wildcard Let’s Encrypt cert for your domain - as this can be verified using DNS and doesn’t require a public facing web server to issue the cert.