Bind MySQL to a private interface

The fix/etc/mysql/mysql.conf.d/mysqld.cnf

[mysqld]
bind-address = 127.0.0.1
mysqlx-bind-address = 127.0.0.1

sudo systemctl restart mysql

Why it matters

Everything else in this cluster hardens a daemon an attacker can still reach. This decides whether they can reach it at all.

An internet-reachable MySQL is a brute-force target with no rate limiting and no account lockout, and a successful login is frequently more than a data breach — the FILE privilege reads and writes files as the mysql user.

The default depends on who packaged it

There is no single answer to “what is the default”, which is why this page leads with checking rather than setting:

• MySQL’s own built-in default binds all interfaces.
• Debian and Ubuntu packages override it to 127.0.0.1 in the shipped config. A packaged install is usually already loopback-only.
• The official Docker images bind all interfaces, correctly — a container that only accepts loopback is useless to other containers. The exposure there is the published port, not this setting.

So the finding isn’t “the default is wrong”. It’s that somebody changed it, or that you’re running a build where the default was never narrowed. Check.

skip-networking is stronger

If nothing connects over TCP — a single-host app talking to a local database, which is extremely common — turn TCP off entirely:

[mysqld]
skip-networking

The server then listens only on the unix socket. There is no port to scan, no port to firewall, and no listener to misconfigure later. It is a strictly stronger position than bind-address = 127.0.0.1, and it costs nothing when every client is local.

Clients then connect via socket, which is the default when you use localhost:

mysql -u app -p appdb                     # socket
mysql -u app -p -h 127.0.0.1 appdb        # TCP — will now fail

Note the MySQL client treats localhost and 127.0.0.1 differently: localhost means the socket, 127.0.0.1 means TCP. That surprises people, and it’s why an app can break on skip-networking even though it’s “connecting to localhost”.

Don’t forget mysqlx

MySQL 8 runs a second listener — the X Protocol on port 33060 — with its own mysqlx-bind-address. Narrowing bind-address and leaving X Protocol on every interface is a common half-fix, because ss output on port 3306 looks correct while 33060 is wide open. Disable it if unused:

[mysqld]
mysqlx = 0

MariaDB has no X Protocol, so this doesn’t apply there.

Verify it worked

Check what is actually listening — both ports:

sudo ss -lntp | grep -E 'mysqld|mariadb'

Expect 127.0.0.1:3306 and nothing on 0.0.0.0. If you see *:33060, the X Protocol listener is still open.

Confirm against the running server, in case a file edit never took effect:

SHOW VARIABLES WHERE Variable_name IN ('bind_address','mysqlx_bind_address','skip_networking');

Then prove it from another host:

mysql -h your.db -u root -p --connect-timeout=5

A timeout is the goal. An authentication prompt means the port is reachable from that network — see MySQL exposed to the internet.

Before you apply this

This requires a restart, which drops every connection, and narrowing the bind disconnects any client not on the remaining interface — permanently, not until they retry.

Find out who is connected first:

SELECT DISTINCT SUBSTRING_INDEX(host, ':', 1) AS client, user
FROM information_schema.processlist
ORDER BY 1;

Every address there must reach the interface you keep. Note this only shows clients connected right now — a nightly batch job, a backup agent or a reporting tool won’t appear. Check your connection strings too.

skip-networking breaks anything using -h 127.0.0.1, including apps whose config says “localhost” but whose driver interprets it as TCP (most non-C drivers do, unlike the MySQL CLI). Grep your application config for 127.0.0.1 and port 3306 before enabling it.

On a cloud instance, also check the security group — removing the listener is not the same as closing the firewall, and the security group is what an internet scanner meets first.

Related

• Authentication plugins — the layer behind this one.
• MySQL exposed to the internet — what this closes.