Description:

This check verifies that no Utho Cloud Security Group permits unrestricted inbound access to the MySQL service (TCP port 3306) from any IPv4 (0.0.0.0/0) or IPv6 (::/0) address. MySQL database servers should only be accessible from trusted application servers, private networks, VPN gateways, or authorized administrator IP addresses. Restricting MySQL access minimizes the risk of unauthorized database access and data compromise.


Rationale:

Exposing MySQL directly to the Internet significantly increases the risk of unauthorized access, brute-force attacks, credential theft, and database compromise. Databases should only accept connections from trusted sources that require access.

This check helps:

  • Prevent unauthorized access to MySQL databases.

  • Reduce the risk of data theft, modification, or deletion.

  • Restrict database connectivity to trusted application servers and internal networks.

  • Meet security best practices recommended by industry compliance standards.


Impact:

  • Reduces the attack surface of MySQL database servers.

  • Prevents Internet-based scanning and attacks targeting MySQL services.

  • Improves the overall security posture of cloud-hosted databases.

  • Clients connecting from unauthorized networks will be unable to access the database until their IP addresses are explicitly allowed.


Default Value:

Utho Cloud Security Groups do not automatically restrict MySQL access. If administrators create an inbound rule allowing TCP port 3306 from 0.0.0.0/0 or ::/0, the Security Group is considered non-compliant.


Pre-requisites

  • Utho Cloud account.

  • Permissions to view and manage Security Groups.

  • Access to the Utho Cloud Console or Utho API.

  • MySQL servers or compute instances protected by Security Groups.


Pre-requisites

  • Utho Cloud account.

  • Permissions to view and manage Security Groups.

  • Access to the Utho Cloud Console or Utho API.

  • MySQL servers or compute instances protected by Security Groups.


Remediation Steps:

Test Plan:

Using the Utho Cloud Console

  1. Sign in to the Utho Cloud Console.

  2. Navigate to Networking → Security Groups.

  3. Select each Security Group.

  4. Review all inbound (Ingress) rules.

  5. Verify that no rule exists with

    • Protocol = TCP

    • Port = 3306

    • Source = 0.0.0.0/0 (or ALL)

                                         OR

  • Source = ::/0 (or ALL)


If an unrestricted Redis rule exists, the Security Group is non-compliant.


Using the Utho API

List all Security Groups (Firewalls).

curl -s -H "Authorization: Bearer $UTHO_API_TOKEN" \
https://api.utho.com/v2/firewall

Retrieve the details of each Security Group.

curl -s -H "Authorization: Bearer $UTHO_API_TOKEN" \
https://api.utho.com/v2/firewall/<FIREWALL_ID>

Implementation Plan:

Using the Utho Cloud Console

  1. Log in to the Utho Cloud Console.

  2. Navigate to Networking → Security Groups.

       

  1. Select the non-compliant Security Group and click Manage.

  1. Locate the inbound rule allowing:

    • Protocol: TCP

    • Port: 3306

    • Source: 0.0.0.0/0 or ::/0

  2. Delete the unrestricted Redis rule.

  1. Create a new inbound rule allowing access only from:

    • Application server Security Groups.

    • Private VPC/Subnet CIDR ranges.

    • VPN gateway IP ranges.

    • Specific trusted administrator or management IP addresses (if administrative access is required).

  1. Save the Security Group.

  2. Verify Redis connectivity from authorized clients only.


Using the Utho API

Delete the unrestricted Redis rule using the Rule ID obtained from the firewall details.

curl -s -X DELETE \
-H "Authorization: Bearer $UTHO_API_TOKEN" \
https://api.utho.com/v2/firewall/<FIREWALL_ID>/rule/<RULE_ID>/delete

Create a restricted Redis rule.

curl -s -X POST \
-H "Authorization: Bearer $UTHO_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
  "type":"incoming",
  "protocol":"TCP",
  "port":"3306",
  "addresses":"10.0.0.0/16"
}' \
https://api.utho.com/v2/firewall/<FIREWALL_ID>/rule/add

Replace 10.0.0.0/16 with your organization's trusted private network or approved CIDR range.


Backout Plan:

  1. Log in to the Utho Cloud Console.

  2. Navigate to Networking → Security Groups.

  3. Select the modified Security Group.

  4. Restore the previous MYSQL rule if legitimate application connectivity is interrupted.

  5. Verify MYSQL connectivity.

  6. Replace the temporary rule with one that restricts access to trusted private networks or approved IP ranges, rather than allowing unrestricted Internet access.

References: