5
  1. Is there any logging available that logs mysql connection attempts to the port, login attempts, and times succeeded with username, IP address and date time? Im trying to detect brute force attempts.
  2. Is there a way to setup a mysql automatic brute force delay?
3

An option is to setup OSSEC (Host-Based Intrusion Detection System):

The default mysql ruleset includes checking for:

rule-id-50105 Database authentication success.

rule-id-50106 Database authentication failure.

rule-id-50107 Database query.

rule-id-50108 User disconnected from database.

rule-id-50120 Database shutdown messge.

rule-id-50121 Database startup message.

rule-id-50125 Database error.

rule-id-50126 Database fatal error.

rule-id-50180 Multiple database errors.

http://www.ossec.net/doc/rules/rules/50_mysql_rules.xml.html

The alerts provide some of the information you want (e.g. timestamp, datetime, username). You can also easily create your own OSSEC rules to capture more details or to create complex rules and actions.

  • 1
    -1, No, if just anyone can connect to mysql then you have seriously ***ed up. OSSEC should never come into play. – rook Mar 10 '12 at 7:10
  • 1
    @Rook - where does he say anyone can connect? what if this mysql instance is only internally accessible? the internal network could be compromised or an employee could be trying to gain illicit access. in either case, OSSEC can help him catch bad activity. – Tate Hansen Mar 10 '12 at 8:55
4

If you have people connecting to mysql you have already seriously fucked up. You need to change your firewall settings to make sure that only trusted hosts can connect and no one else.

An attacker could easily summon a bot net of 1,000,000 in size to brute force your mysql server. You need a white list approach to this problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.