Mysql blocked my webserver max_connect_error reached [closed]

Question

Last week end, one of my two webservers was blocked by mysql server. The result is all requests on that blocked webserver show a taylored error page.

I'm thinking to implement a script to prevent this issue. but i can't reproduce this error in my test lab.

Mysql doc says that this error is du to network problems and it is a security implementation to bloc attacks.

Do you have ideas about how to reproduce this error?

i tryed to connect to my test server with wrong login/pwd to simulate a brute force attack. Also i executed a complicated queries which took some minutes to get an answer and stopped it in before getting answer (many time).

I saw variable Aborted_connects increasing but not Aborted_clients and i did't get my host blocked by this test server.

Any idea?

Thank you in advance.

Answer 1

I know it is old, but i found the way to reproduce it.

First you have to lower down max_connection_error to not repeat yourself:

SET GLOBAL max_connect_errors=2;

then you can use telnet program to make faulty connections. after command just double press enter:

$ telnet 192.168.128.98 3306

Trying 192.168.128.98...
Connected to 192.168.128.98.
Escape character is '^]'.
a
5.6.14-1+debphp.org~precise+1?"sC1kHf?s,{MO$dK-<(Smysql_native_password    
!#08S01Got packets out of orderConnection closed by foreign host.

$ telnet 192.168.128.98 3306

Trying 192.168.128.98...
Connected to 192.168.128.98.
Escape character is '^]'.
a
5.6.14-1+debphp.org~precise+1?"sC1kHf?s,{MO$dK-<(Smysql_native_password

!#08S01Got packets out of orderConnection closed by foreign host.

then you will see your connection refuse:

$ telnet 192.168.128.98 3306

Trying 192.168.128.98...
Connected to 192.168.128.98.
Escape character is '^]'.
kHost '192.168.128.1' is blocked because of many connection errors; unblock with 'mysqladmin flush-hosts'Connection closed by foreign host.

Answer 2

If there are more than this number of interrupted connections from a host, that host is blocked from further connections. You can unblock blocked hosts with the FLUSH HOSTS statement.
If a connection is established successfully within fewer than max_connect_errors attempts after a previous connection was interrupted, the error count for the host is cleared to zero. However, once a host is blocked, the FLUSH HOSTS statement is the only way to unblock it.

Source: http://dev.mysql.com/doc/refman/5.1/en/server-system-variables.html#sysvar_max_connect_errors

Note that the default value in MySQL 5.1.x is set at 10.

EDIT: If you want to try crafting invalid TCP packet hoping that it will generate connect errors in mysql you should look at those two tools:

• Scapy and this tutorial
• Nemesis and this manpage
• GSpoof which may be the simplest of all three due to its GUI

I suppose it will generate the error you want but I never tried it.