Home / server / Questions / 335586
Accepted
KCD
Asked: 2011-11-29 13:32:58 +0800 CST

Wrong DNS name for client when client connects to MySQL - how to use another client host name?

  • 772

I'm trying use a host restricted MySQL user when connecting from one Amazon EC2 instance to another. I wanted to use elastic ip address for their dns function, but you can probably ignore the Amazon EC2 references in this question.

I think my question is how to define the dns name of the mysql client by the client when the connecting as a user to mysql?

I apologise if I have problem wrong. Perhaps it is more generic - how do define local machines host name for use with any outgoing connection?

The problem is the client app has two dns names but I need to to use the other. The details are:

Public                                    
db.fixedip.amazonaws.com                  app.fixedip.amazonaws.com
-------------------------------------------------------------------------------
Internal
db.randomdns.ec2.internal                 app.randomdns.ec2.internal

Actual machine instance
MySQL on Linux                            App on Windows 2003
'user'@'app.fixedip.amazonaws.com'

From app

mysql -uuser -p -hdb.fixedip.amazonaws.com
ERROR 1130 (HY000): Host 'app.randomdns.ec2.internal' is not allowed to connect to this MySQL server

db.fixedip.amazonaws.com conveniently resolves to the internal IP address (which can change) but the MySQL client isn't identified as its non-random app.fixedip.amazonaws.com public dns name.

This doesn't seem to work :)

mysql [email protected] -p -hdb.fixedip.amazonaws.com

UPDATE: The current answer redefines the problem - don't bother with hosts in mysql and use alternative host restriction. I'll accept that unless anyone else would like to comment on the original question

windows-server-2003 domain-name-system mysql internal-dns amazon-ec2

1 Answers

  1. Best Answer

    A standard way to implement secure MySQL database access in EC2 is to use EC2 security groups. Only allow connections to the MySQL database server port (3306) from EC2 instances in a specific security group, say, "dbclient". Put any database client EC2 instance in the "dbclient" security group.

    Configure MySQL itself to allow connections from your authenticated user at any host ("%").

    This gets around the problem of having to keep track of what the internal IP addresses are for all of your EC2 instances, especially since these change when you stop and start an instance, even if you assign elastic IP addresses.

    Here's an article I wrote that can help you connect from the database client to the database server using an internal IP address based on an Elastic IP address DNS name for the server:

    Using Elastic IP to Identify Internal Instances on Amazon EC2
    http://alestic.com/2009/06/ec2-elastic-ip-internal

    This helps get around the problem of the database server IP address changing when it is stopped and started or replaced.

    • 1