1

since i am completely new to web hosting and setting up web servers, please excuse my dumb questions ;)

Yesterday i uploaded my web application on digitalocean. The application is a very simple website with user login (build with Python) to display resulting data from periodical tasks (executing a long running task one time per day and very short running tasks every minute).

Everything is build with docker. The whole stack comprises the webserver (NGINX), database server (mariadb) and message broker (rabbitmq, needed for the periodic tasks).

After i fired up the application everything ran stable for about 2 hours, until it crashed for the first time (little issue with the database connection). To discover what specifically caused the crash i logged into the logs of the mariadb container and i saw the following (beside the real cause of the crash):

[Warning] Access denied for user 'chucky'@'85.87.19.37' (using password: YES)

The thing is, i am the only user and i didn't set up a user named 'chucky'. So for me it looks like somebody found out the IP address of my digitalocean droplet and tried to logged into the website. Do i interprete this correctly? If so, i am totally wondering how somebody could find out the IP address of a new, fresh droplet so quickly?

Beside that i was wondering how somebody would "hack" the droplet if nothing is installed. So only the raw, empty droplet - nothing installed. Is that even possible or must there always be a webserver (or database server), serving as some kind of "gateway", to get access to the server's file system?

Thank you guys in advance and I am very curious to hear your answers.

1

Bots are permanently trying to access every publicly accessible resource, this is normal and considered background noise.

But: In your configuration, MariaDB should not be publicly accessible to begin with, only between private addresses/containers on the host. You should only expose things to the public that must be exposed (e.g. the webserver and the SSH server on the droplet itself), nothing else.

  • heya Sven, thanks for your quick reply! That really acquiesces me. And big thanks for your hint with the port exposition. I already adapted my docker-compose file so that both mariadb and rabbitmq wont be publicly accessible anymore. – chickenshifu Aug 28 '19 at 17:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.