Remote Database Access

Accessing MariaDB Remotely

By default, BlitzPress configures MariaDB to only accept connections from localhost. If you need remote access (for tools like MySQL Workbench, TablePlus, or HeidiSQL), there are two methods: direct access (less secure) and SSH tunnel (recommended).

Method 1: SSH Tunnel (Recommended)

An SSH tunnel forwards your local port to the remote MySQL port through an encrypted SSH connection. No changes needed on the server.

# On your local machine
ssh -L 3307:127.0.0.1:3306 debian@YOUR_SERVER_IP

Then connect your database client to 127.0.0.1:3307 with your WordPress database credentials. The connection is encrypted via SSH.

Using TablePlus/MySQL Workbench with SSH Tunnel

Most database GUI tools have built-in SSH tunnel support:

SSH Host: YOUR_SERVER_IP
SSH User: debian (or your SSH user)
SSH Key/Password: your SSH credentials
MySQL Host: 127.0.0.1
MySQL Port: 3306
MySQL User: from wp-config.php (DB_USER)
MySQL Password: from wp-config.php (DB_PASSWORD)

Method 2: Direct Remote Access (Less Secure)

If you must allow direct remote connections:

# Step 1: Change bind-address
sudo sed -i "s/bind-address.*/bind-address = 0.0.0.0/" /etc/mysql/mariadb.conf.d/50-server.cnf

# Step 2: Create remote user
sudo mysql -e "CREATE USER 'remote_user'@'YOUR_IP' IDENTIFIED BY 'strong_password';"
sudo mysql -e "GRANT ALL PRIVILEGES ON your_database.* TO 'remote_user'@'YOUR_IP';"
sudo mysql -e "FLUSH PRIVILEGES;"

# Step 3: Open firewall
sudo ufw allow from YOUR_IP to any port 3306

# Step 4: Restart MariaDB
sudo systemctl restart mariadb

Security Best Practices

Prefer SSH tunnels over direct remote access
If using direct access, restrict to specific IPs only (never '%')
Use a separate database user for remote access with minimal privileges
Always use a strong, unique password
Consider using require_secure_transport = ON to force SSL for remote connections

Finding Your Database Credentials

sudo grep -E "DB_(NAME|USER|PASSWORD|HOST)" /home/DOMAIN/public_html/wp-config.php