1

I am using aws ec2 t2 instance. Where I created few database as per my requirement.

For last few day I noticed new databases which I create getting deleted automatically. Is there any possibility of automatically getting deleted?

Current I have not put any password on phpmyadmin. Also no one other then me knowing IP of this server.

Any clue why it is getting deleted and tips to secure it?

closed as off-topic by ceejayoz, Dave M, rnxrx, bodgit, chicks Jan 3 at 3:33

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions should demonstrate reasonable business information technology management practices. Questions that relate to unsupported hardware or software platforms or unmaintained environments may not be suitable for Server Fault - see the help center." – ceejayoz, Dave M, rnxrx, bodgit, chicks
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    "also no one other then me knowing IP of this server" thats not true. If its a public ip, its there for everyone with a port scanner tool. – Mr Zach Dec 27 '18 at 6:58
  • @MrZach: Yes, i just checked, someone created new databse in it with Warning that they have deleted all database and asking for bitcoin. How do they attack and how to secure from them, any idea? – user3449212 Dec 27 '18 at 7:03
  • 1
    Two key things 1) Change the database admin user / password 2) Ensure that no-one on the internet can access the database using security groups. AWS or security training would help. – Tim Dec 27 '18 at 8:36
  • A single actor can scan every IPv4 address on the Internet in a few hours. You cannot rely on "no one other then me knowing IP of this server". Automata will try to break in every hour of every day. You have to be secure from the first moment you start your server. – Michael Hampton Dec 27 '18 at 21:22
  • @user3449212 If the response below answered your question please upvote and accept it. That's the ServerFault way of saying Thanks :) – MLu Feb 19 at 20:48
2
  1. Thoroughly read Making MySQL Secure Against Attackers and implement the recommendations.
  2. Restrict access to the EC2 through Security Group
    • Only permit access to the database (port 3306) from the IP addresses where your web application lives (if it's on the same server don't open access to port 3306 at all).
    • Only permit access to phpMyAdmin and SSH from your IP (e.g. your home connection).
  3. Set password for phpMyAdmin
  4. Use HTTPS to access phpMyAdmin, e.g. use free LetsEncrypt certificate.
  5. Consider using Adminer which is similar to phpMyAdmin and enforces some basic security.
  6. Read or get some training about security essentials - both general and cloud-related.

Hope that helps :)

Not the answer you're looking for? Browse other questions tagged or ask your own question.