Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Searching the internet with search engines on MySQL and fail2ban yields lots of results on putting your fail2ban logs into MySQL, however I'm wanting to monitor failed MySQL attempts to log in and ban those IP's.

My application requires that I keep a port for MySQL open, though I have changed the default port for added security. For extra security though, I would like to monitor the MySQL logs with fail2ban.

Does anyone have a quick guide to configuring fail2ban for MySQL? I have it already installed and working on a couple of other services, so you can skip the installation part and jump right to configuring the config file or whatever else is necessary.

share|improve this question

3 Answers 3

I think this is probably what you're after MySQL Fail2Ban

There's more on that main page here: MySQL general log timestamps

share|improve this answer
    
You may have misread the question. Those links do not relate to what is being asked for. –  John Gardeniers Mar 30 '11 at 6:50
    
I get lots of those kinds of links when searching, but I'm asking a different question. How do I setup fail2ban to read MySQL access logs and ban IP's based on the failed login attempts in the logs. –  InvisibleFrisbee Mar 30 '11 at 14:07
    
Whoops ! Have a look at http://www.voip-info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk This gives some info on how to do that for Asterisk. Does that help ? –  Jonathan Ross Mar 30 '11 at 15:08
    
This logs TO a MySQL database but more importantly mentions failregex formatting. Hopefully it will help: http://blog.dp.cx/25/postfix-fail2ban-win –  Jonathan Ross Mar 30 '11 at 15:12

According to this guy ( http://forums.mysql.com/read.php?30,205612,205612 ) What you are trying to do is not possible.

Also: «the use of mysql.log is described as a performance killer and I heard that it should be obsoleted in next Mysql versions. »

I was looking for the same thing. It is suggested that you block the 3306 port on your firewall. If it's not an option, then, good luck.

share|improve this answer

You could enable mysql logging:

[mysqld]
log = /var/log/mysql/access.log
log_error = /var/log/mysql/error.log
log_warnings = 2

so that communication errors would show up in the log and then monitor that file with fail2ban.

http://dev.mysql.com/doc/refman/5.1/en/communication-errors.html

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.