Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to turn on networking for MySQLd, but every time I do, the server gets brute-forced into oblivion. Some mean password guessing script starts hammering on the server, opening a connection on port 3306 and trying random passwords forever.

How can I stop this from happening?

For SSH, I use denyhosts, which works well. Is there a way to make denyhosts work with MySQLd?

I've also considered changing the port MySQL is running on, but this is less than ideal and only a stop-gap solution (what if they discover the new port?)

Does anyone have any other ideas?

If it makes a different, I'm running MySQL 5.x on FreeBSD 6.x.

share|improve this question
add comment

7 Answers

up vote 6 down vote accepted

I don't know of any denyhosts-like software packages for MySQL, but I do have a couple of solutions:

  • Limit login to specific IP addresses. Do not use % to allow for all hosts to connect to the server.
  • Even more secure, set up iptables to only allow access to 3306 from authorized IP addresses.
  • Tunnel your traffic to the box with ssh then connect via localhost
  • Modify the Denyhosts or BFD scripts to analyze mysql access logs and block any brute force attempts at the firewall

Edit:

To answer your comment, try this:

iptables -A INPUT -p tcp -s 202.54.1.50 --sport 1024:65535 -d 202.54.1.20 --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -s 202.54.1.20 --sport 3306 -d 202.54.1.50 --dport 1024

Where .20 is your MySQL and .50 is the remote connecting IP address.

share|improve this answer
    
A few notes: How can I restrict access to port 3306 to only a given set of IP addresses? Just restricting the MySQL users does not work, as remote machines can then still connect and brute-force for passwords. SSH tunnels seem somewhat inconvienent to set up for the end-user... Do you have an IPTables example of doing this? –  Keith Palmer Sep 22 '09 at 20:16
add comment

Using MySQL Proxy, you could write a small LUA script that takes a user/pass combination but waits X seconds to process the login if the connection request comes from an unapproved IP range.

You could furthermore add a bit of extra logic to the LUA script to blacklist IP ranges after three failed attempts.

All in all, it's technically doable, but I'm going with the other recommendations to tunnel via SSH or a VPN to a common, whitelisted (via FW or other means) IP range.

share|improve this answer
    
+1 yet another use for MySQL Proxy :) –  Andy Sep 23 '09 at 14:49
add comment

why not allowing acces to the mysqld port from only secure hosts ?

share|improve this answer
    
I considered this, but that means I'd have to monitor IP address changes for like 1,000+ clients. That would be a gigantic pain in the butt... How can I do this anyway? It doesn't help to lock them out within MySQL, because they can still connect to the MySQL server, just not actually choose any databases... –  Keith Palmer Sep 22 '09 at 19:58
1  
quoting dave drager above: "Modify the Denyhosts or BFD scripts to analyze mysql access logs and block any brute force attempts at the firewall" seems the best idea or use some hierogliphic passwords :) –  petre Sep 22 '09 at 20:14
add comment

While this is not a "real" answer - I do not know why you need to expose it to the outside world directly.

Can't you enable ssh on that box, and use tunneling to access the db engine?

Or any other VPN solution to access it (openvpn comes to mind).

share|improve this answer
add comment

Not a real solution to the problem, but it might help if you just run the server on a different port. Most of those scanning bots are probably programmed to just check 3306. It won't solve the issue, but you'll probably get a lot fewer scans by just changing the port.

share|improve this answer
    
-1 for security by obscurity –  thepocketwade Sep 23 '09 at 15:06
    
@thepocketwade - Which is why I said it's not a real solution to the problem. But it could still be helpful. –  Eric Petroelje Sep 24 '09 at 16:34
add comment

I believe connections should be firewalled: fast and nice. There's plenty of tutorials for iptables and whatever :)

Also you can install a cronjob on clients' hosts that will run smth on a server to prevent firewall from blocking known hosts.

share|improve this answer
add comment

using ssh for tunnels would be the best but you could try to use fail2ban instead of denyhosts because i think it's aimed towards monitoring more different appications so it shouldn't be a problem adding the mysql log to it.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.