0

We are getting dictionary attacks to our SQL server, So I wanted to block some of the IP's using shorewall blacklist. I mentioned the IP in /etc/shorewall/blacklist as

#ADDRESS/SUBNET         PROTOCOL        PORT
    Some IP                         

did not work, So I tried again like below but again it's not working

#ADDRESS/SUBNET         PROTOCOL        PORT
     Some IP             -                -

I have this configuration BLACKLIST_DISPOSITION=DROP, and I am using shorewall version 4.4.6
Is there anything I have to check or add?

3 Answers 3

3

Typically, a better strategy in this case is to be proactive. There is very rarely a case under which it is necessary to expose a SQL server to the entire public Internet; consider using a VPN or a firewall to restrict access to only those hosts (or networks) that have some reason to be connecting to it.

If the host originating the bruteforce attack is under your control, address the root cause (either a compromised machine or a malicious user).

That said, ensure that the blacklist option is specified for the interface from which the nuisance traffic is arriving, or the blacklist won't be checked for any traffic coming in on that interface.

3

Your Shorewall configuration appears as though it should work but shorewall is a twisty maze of minor releases and changes so it's difficult to be sure. On later versions you need to edit /etc/shorewall/zones and add blacklist to the IN options to enable blacklists for a particular zone. Even later versions use different files and remove the /etc/shorewall/blacklist file completely. You would be better off upgrading to a newer version.


Having said that, having an sql server on the public internet is not a good thing. You really should have it properly firewalled with a whitelist or better still have it available only over a VPN with the public internet completely blocked.

0

I ran into this problem

I must say I didn't read the shorewall documentation for the last years, and, upgrade after upgrade, my configuration wasn't reliable.
I just discovered the command shorewall update which check AND CONVERTS everything.

Thus, if you have your DYNAMIC_BLACKLIST=Yes, BLACKLIST_DISPOSITION=DROP set in shorewall.conf, then your blacklist file (now named /etc/shorewall/blrules, in shorewall 5.x at least) should work.

Anyway, don't let a MySQL port open publicly, for no reason.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .