Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there such a thing as mysql logs to determine if anything has been accessed/updated/removed. My account was compromised and it appears only spam scripts were uploaded.

I changed all passwords and installed a brute force detection. (I am not sure how they brute forced my password to begin with)

share|improve this question

migrated from superuser.com Apr 11 '11 at 13:37

This question came from our site for computer enthusiasts and power users.

3  
The only thing you should be considering at this point is nuke from space and reinstall from known good backups. –  Iain Apr 11 '11 at 13:44
add comment

2 Answers

Yes, if configured so.

Manual >> 5.2. MySQL Server Logs

If the Binary Log has been configured, you can pretty much see any activity that has changed data, and also replay up to a certain point. Could prove useful if there has been a SQL-injection type of attack.

But considering the question I take it that you are not familiar with MySQL administration, and I therefore suggest you try to find someone to help you out.

share|improve this answer
add comment

What has been compromised? Was it a shell account with extended privileges or mysql? Do you feel you need to preserve evidence for an investigation or are you just trying to get back online ASAP? If it was mysql, the first step I would take is to prevent access from externally by setting the below in my.cnf. Once you have this you can start to take stock of the situation.

bind-address = 127.0.0.1

If you are concerned about mysql changes then a very simple way is to do an mysqldump of the db from now and compare it to one in your offsite backup from before the compromise. It will be quite verbose but should highlight the changes to you.

As far as I am aware, mysql only logs changes if you have it set in debugging mode but this is slow and verbose and not recommended at all.

If you suspect your shell account has been compromised then I would suggest you carefully examine /etc/passwd /etc/group etc and then start the process of building a more secure environment and shifting your application to it(there is a much longer post required about this which I'm not able to do right now but am sure someone else will be able to help ).

share|improve this answer
    
It was a shell account, they are no longer in the server, they just used it for spam based on my hosts investigation. I did a mysql dump and compared databases and nothing changed out of the ordinary. I was online the whole time. –  Chris Muench Apr 11 '11 at 14:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.