Years ago I was advised to use two servers for hosting a basic Linux webserver, that it's best to have SQL hosted separately from NGINX or Apache. Personally I prefer MariaDB over MySQL, but I don't believe in this situation that makes a difference.

This was probably less than 10 years ago, and my Google searching only brings up article that are several years old at best, but closer to 10 years for most of them. I haven't really found anything suggesting hosting them separately that is fairly recent.

Is this suggestion still worth following, or has something changes to make it no longer necessary? As long as my SQL usernames aren't using wildcards, SSH moved to a non-22 port with root login disabled, I should be fine. Right?

  • I can only speak about performance as I'm not a Unix person. Generally speaking, DB servers are optimized similarly to web servers. I.e., lot's of memory for caching and fast disk IO. In my experience, if you're simply hosting a basic web site, you can combine the two on a single machine. If you're handling 10's of 1000's hits a day, separating them would be wise so the two services are not competing for the same resources. – Trebor Feb 15 at 15:24
  • @Trebor So the suggestions in the past were based entirely on performance, and not a security measure? – Admish Feb 15 at 16:44
  • My expertise was with the Microsoft IIS, MS SQL and Oracle DB. For those products I never saw a security issue raised by any of the vendors or any of my clients with cohosting. – Trebor Feb 16 at 2:01

I think the answer depends on your goals and priorities.

If you are planning on having very large deployments, or need a system with multiple frontends having the database on a separate server allows you to split the load and can provide better performance overall with better scalability. Likewise if the database server is only reachable on a LAN and not directly from the Internet it is that much harder to compromise.

On the flip side, if you have powerful servers and are trying to get the absolute best performance, hosting SQL on the same VM is likely to be faster because you don't have the network IO to contend with.

In practice, most small sites would have the database on the same host as the webserver, while large deployments will have dedicated database servers - generally with the infrastructure designed to maximise performance for the environment.

Moving SSH to a port other then 22 is, IMHO, a waste of effort. If you care about security, locking down SSH to only allowed IP addresses using a firewall (and using a VPN to overcome the limitations of dynamic IP's and allowing an additional layer of security) is a way better best practice. More importantly though if you are running an SQL database you should ensure it is not reachable from the wider Internet. This can typically be done by only allowing access from the loopback interface or For added security, firewall off port 3306 (for MySQL) or 5432 (for Postgres) - this will offer most of the security of having it on a separate box which is not available on the Internet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.