Databases, with no open port.
A database should never be reachable from the internet. SSHepherd makes certain it is not.
What an open databases port gives away
Database ports are enumerated constantly, and a reachable instance gives an attacker a great deal before authentication: the engine, the version, and often enough of a banner to select an exploit.
Exposure is usually accidental rather than intended — a security group left broad during a migration, a bound address changed for troubleshooting, a replica stood up outside the original network design. It only has to happen once.
The port is closed, not hidden.
SSHepherd closes the listening port on the database host. There is no socket for a scanner to find, whatever the firewall rules happen to say.
Application servers and administrators reach the database over authorised outbound connections through the broker, so legitimate traffic continues while the port stays shut.
- Nothing listens inbound
- Access via broker only
- Every session monitored
What your customer notices
Authorised application traffic continues over the broker; connection logic does not have to be rewritten.
An over-broad firewall rule no longer exposes the instance, because there is no listener behind it.
Administrative connections are tied to an authorised identity rather than a network location.
Sessions are recorded, so administrative access to production data can be evidenced.
Watch the databases demo.
SSHepherd® and MySQL. A recorded demo from Full Armor, the developer of SSHepherd®.
Databases: common questions
Will my applications still be able to reach the database?
Yes. Authorised application traffic is carried through the broker over an outbound connection. What is removed is the inbound listening port that anyone could scan.
Which database engines does this cover?
SSHepherd works at the port level, so it covers Microsoft SQL Server, MySQL and PostgreSQL alike, along with other TCP services on the same host.
Does this replace our firewall?
No, it makes the firewall less load-bearing. A firewall decides who may reach a service that is listening; SSHepherd removes the listener, so a mistaken rule no longer results in exposure.