do most web hosts allow database access directly?

[mrgreenjc]

We have an information portal that is setup on an ancient ColdFusion page, and it's backed by a MySQL database. All that works fine. I discovered that by just entering the hostname (mysql21.hostingcompany.com) and creating a database user, I was able to use the mysql client over the internet directly.

Maybe I'm paranoid, but usually I limit TCP/IP database access to be behind a firewall and only from trusted hosts. Am I overly cautious, or is this webhost just kind of lax on the firewall rules?

At the end of the day I doubt we'd drop them over something like this, the info that's stored here is super trivial, and we're looking at costs of like $19/month which is less than the coffee budget for the 3-person tech support group. I was just curious to know others' experience, because this is the only web hosting company I have out there right now.

 

[CyborgHost]

Your caution is entirely justified, and it's good thing to limit TCP/IP database access to trusted hosts behind a firewall. Allowing open internet access to your database server, as you've described, can be a significant security risk. It's possible that your hosting company has less restrictive firewall rules in place, or they may have made a configuration oversight.

While it might not be a critical issue for your current setup, it's generally recommended to follow best security practices to protect your data.

 

[bigredseo]

Not normal, but many hosts are configured this way. It stops the need for a ticket to be opened (if they don't have an automated system in place for opening/closing IPs. cPanel by default is restricted and can be managed from the control panel, but other control panels are not necessarily configured this way.

Notify the host and tell them that the database should be restricted from all IPs except those you define.
They should be able to do this, even on a shared host we never allowed direct access unless defined.

If they say why they don't, then that might be reason to figure out if you want to stay or not.

Laziness is not an excuse for security.

 

[pratik08]

Yes, many web hosts allow direct database access, providing users with the flexibility to manage and interact with their databases efficiently.