Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Last week end, one of my two webservers was blocked by mysql server. The result is all requests on that blocked webserver show a taylored error page.

I'm thinking to implement a script to prevent this issue. but i can't reproduce this error in my test lab.

Mysql doc says that this error is du to network problems and it is a security implementation to bloc attacks.

Do you have ideas about how to reproduce this error?

i tryed to connect to my test server with wrong login/pwd to simulate a brute force attack. Also i executed a complicated queries which took some minutes to get an answer and stopped it in before getting answer (many time).

I saw variable Aborted_connects increasing but not Aborted_clients and i did't get my host blocked by this test server.

Any idea?

Thank you in advance.

share|improve this question

closed as off-topic by Chris S Feb 5 at 16:02

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must be relevant to professional system administration. Server Fault is dedicated to professional system and network administrators. End user and enthusiast questions are off-topic (contact your system administrator or hire a professional to help you out). Please see the Help Center for more information." – Chris S
If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers 2

up vote 1 down vote accepted

I know it is old, but i found the way to reproduce it.

First you have to lower down max_connection_error to not repeat yourself:

SET GLOBAL max_connect_errors=2;

then you can use telnet program to make faulty connections. after command just double press enter:

$ telnet 192.168.128.98 3306

Trying 192.168.128.98...
Connected to 192.168.128.98.
Escape character is '^]'.
a
5.6.14-1+debphp.org~precise+1?"sC1kHf?s,{MO$dK-<(Smysql_native_password    
!#08S01Got packets out of orderConnection closed by foreign host.

$ telnet 192.168.128.98 3306

Trying 192.168.128.98...
Connected to 192.168.128.98.
Escape character is '^]'.
a
5.6.14-1+debphp.org~precise+1?"sC1kHf?s,{MO$dK-<(Smysql_native_password

!#08S01Got packets out of orderConnection closed by foreign host.

then you will see your connection refuse:

$ telnet 192.168.128.98 3306

Trying 192.168.128.98...
Connected to 192.168.128.98.
Escape character is '^]'.
kHost '192.168.128.1' is blocked because of many connection errors; unblock with 'mysqladmin flush-hosts'Connection closed by foreign host.
share|improve this answer
    
Hi.Thank you for your answer. I was not able to try the tools suggested above. +1 for the proposed solution :) –  LotfiK Feb 10 at 15:40

If there are more than this number of interrupted connections from a host, that host is blocked from further connections. You can unblock blocked hosts with the FLUSH HOSTS statement.
If a connection is established successfully within fewer than max_connect_errors attempts after a previous connection was interrupted, the error count for the host is cleared to zero. However, once a host is blocked, the FLUSH HOSTS statement is the only way to unblock it.

Source: http://dev.mysql.com/doc/refman/5.1/en/server-system-variables.html#sysvar_max_connect_errors

Note that the default value in MySQL 5.1.x is set at 10.

EDIT: If you want to try crafting invalid TCP packet hoping that it will generate connect errors in mysql you should look at those two tools:

I suppose it will generate the error you want but I never tried it.

share|improve this answer
    
Thank you for the replay. I did this when i noticed that my webserver is blocked. But my question was how to reproduce this issue? I would like to monitore connection_errors variable in order to avoid a next host blocking. Thank you –  LotfiK Feb 10 '12 at 13:35
    
Given what you already tried without success and the doc stating that this error is due to "network problems", you may want to look at crafting your own invalid TCP packets, I'll add details in my question. –  Shadok Feb 10 '12 at 14:48
    
I'll try them and give a feed back. Thank you. –  LotfiK Feb 10 '12 at 15:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.