3

I have an Ubuntu server with a MySQL database that is only accessed from localhost.

  1. Is there any default mechanism in MySQL (or Ubuntu) that logs connection attempts, so I can check if the database has been (attempted) accessed from the outside?

  2. If not, is it possible to enable such a mechanism?

The best would be to have a logging mechanism that logs only remote attempts, and not local (legitimate) access which there would be millions of, so it would be easy to spot the remote ones.

2

To enable log:

In /etc/my.cnf:

general_log_file = /var/log/mysql/mysql.log general_log = 1

There are botnets scanning for ports 3306, so if you didn't had a password for root account then definitely yes.

Such access is not normally logged because on servers with PHP there's usually one new connection per each request, so logging it is a bit of overhead.

Make sure you have root password setup. You can use MySQL Workbench to inspect users. Check if new connections are accepted only from localhost (e.g. users permitted are only from localhost - 127.0.0.1).

On the side note, if you use MySQL for development of you own application you may be better with upgrading it to newer version. It is because MySQL as part of OS is VERY old because of old applications compability. Newer versions allow for creation of different class of apps, especially if it comes to reporting and documents. You can add new repo and do apt-get update. In Centos7 for example there's MariaDB, and in latest Fedora there's version 10.1 by default.

  • There was no /var/log/mysql/mysql.log, but I found a week's worth of /var/log/mysql/error.log. Would it contain any information about attempts from the outside? – forthrin Aug 1 '16 at 21:28
2

I feel this is the wrong way to go about it. Even if you knew that someone has breached the system, it might be too late to prevent damage. Also, if the someone is proficient enough, he'll detect an unshielded Ubuntu system and try to break in, say, one Friday evening. By the time Monday morning comes, the logs might show nothing and the system will report business as usual with a straight face and an earnest expression.

What you want is that nobody connects to the system.

If you do not need connections from anywhere else but localhost, do not even bind the interface. You can skip TCP networking altogether and only connect through a local socket (if memory serves, there's a setting in my.cnf - something like skip-networking or skip-tcp-networking).

If you need to use TCP connections, then use the firewall to deny any inbound connections to port 3306/tcp on all interfaces except 'lo', localhost.

This will consume next to no resources, and will give you far greater security and peace of mind. Of course nothing stops you from doing both - prevent logins, and log any that might nonetheless somehow succeed.

  • In addition to using a firewall (just in case, as an extra layer) you can configure MySQL to only bind to ::1 or 127.0.0.1, so that even though you can connect to it from the local host, there is no way to connect from outside. – André Borie Aug 2 '16 at 2:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.