Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.
  1. Is there any logging available that logs mysql connection attempts to the port, login attempts, and times succeeded with username, IP address and date time? Im trying to detect brute force attempts.
  2. Is there a way to setup a mysql automatic brute force delay?
share|improve this question

2 Answers 2

up vote 3 down vote accepted

An option is to setup OSSEC (Host-Based Intrusion Detection System):

The default mysql ruleset includes checking for:

rule-id-50105 Database authentication success.

rule-id-50106 Database authentication failure.

rule-id-50107 Database query.

rule-id-50108 User disconnected from database.

rule-id-50120 Database shutdown messge.

rule-id-50121 Database startup message.

rule-id-50125 Database error.

rule-id-50126 Database fatal error.

rule-id-50180 Multiple database errors.

http://www.ossec.net/doc/rules/rules/50_mysql_rules.xml.html

The alerts provide some of the information you want (e.g. timestamp, datetime, username). You can also easily create your own OSSEC rules to capture more details or to create complex rules and actions.

share|improve this answer
    
-1, No, if just anyone can connect to mysql then you have seriously ***ed up. OSSEC should never come into play. –  Rook Mar 10 '12 at 7:10
1  
@Rook - where does he say anyone can connect? what if this mysql instance is only internally accessible? the internal network could be compromised or an employee could be trying to gain illicit access. in either case, OSSEC can help him catch bad activity. –  Tate Hansen Mar 10 '12 at 8:55

If you have people connecting to mysql you have already seriously fucked up. You need to change your firewall settings to make sure that only trusted hosts can connect and no one else.

An attacker could easily summon a bot net of 1,000,000 in size to brute force your mysql server. You need a white list approach to this problem.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.