Configuring Remote MySQL Access on Linux

1 min read .

Published on 29 Sep 2022

Configuring Remote MySQL Access on Linux

MySQL installations are commonly configured to listen only on a local interface. If a database must accept connections from another machine, you need to adjust the server’s listening address, create an appropriately scoped account, and make sure the network firewall allows only the required clients.

Step 1: Update the MySQL Configuration

Edit the MySQL configuration file

On Ubuntu and Debian installations, a common file is:
```
sudo nano /etc/mysql/mysql.conf.d/mysqld.cnf
```
Change bind-address

Find the bind-address setting. To listen on all IPv4 interfaces, set:
```
bind-address = 0.0.0.0
```
Listening on every interface increases exposure, so prefer binding to a specific private/server address when possible and restrict port 3306 with a firewall.
Save the file

In nano, press Ctrl+O, confirm with Enter, then press Ctrl+X.

Step 2: Restart MySQL

Apply the configuration change:

sudo systemctl restart mysql

Step 3: Create a Remote-Access Account

Open the MySQL client
```
mysql -u root -p
```
Create a dedicated account

Avoid exposing the MySQL root account remotely. Instead, create a separate user and restrict its host whenever you know the client address. For example, to allow one client at 203.0.113.25:
```
CREATE USER 'appadmin'@'203.0.113.25' IDENTIFIED BY 'use-a-strong-password';
GRANT ALL PRIVILEGES ON mydatabase.* TO 'appadmin'@'203.0.113.25';
```
If you deliberately need an account that can connect from any host, % is the wildcard host value:
```
CREATE USER 'appuser'@'%' IDENTIFIED BY 'use-a-strong-password';
GRANT SELECT, INSERT, UPDATE, DELETE ON mydatabase.* TO 'appuser'@'%';
```
Use the narrowest privileges and host scope that satisfy your application requirements.
Exit MySQL
```
EXIT;
```

Step 4: Restrict Network Access

If the host uses a firewall, allow MySQL only from trusted client addresses. For example with UFW:

sudo ufw allow from 203.0.113.25 to any port 3306 proto tcp

Do not expose port 3306 to the public internet unless you have a clear operational reason and additional protections. A private network, VPN, SSH tunnel, or managed database network policy is usually safer.

Conclusion

Remote MySQL access requires changes at both the database and network layers: MySQL must listen on an appropriate interface, the account must permit the expected client host, and the firewall must allow the connection. Keep the exposure and privileges as narrow as possible rather than enabling unrestricted remote root access.