Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm a student in computer security, and I often see this when performing an nmap scan on the training lab I'm using:
3306/tcp open MySQL (unauthorized; French)
I'm wondering what unauthorized means, what is unauthorized and why? Also, what is the meaning of French aside unauthorized? Finally, are there possible consequences in term of security (and what are they)?
When nmap tries to identify a service it tries to read the banner that the service presents to a connecting client.
In this case, the banner shows the string "unauthorized" and might be in French. You can confirm this with nc or telnet and performing a banner grab manually.
There's no specific security issue here. It's just banner contents.
MySQL database server defines users together with the hosts they are allowed to connect from. If no users are allowed to connect from the IP you are scanning from, MySQL will return an error stating "Host X is not allowed to connect to this MySQL server" in the language mysqld is running under. Nmap has specific match lines for some of these languages, and will notify you in the "extrainfo" field of the product version. In this case, the match line looks like this:
match mysql m|^.\0\0\0\xff..Le h\xf4te '[-.\w]+' n'est pas authoris\xe9 \xe0 se connecter \xe0 ce serveur MySQL$| p/MySQL/ i/unauthorized; French/ cpe:/a:mysql:mysql::::fr/
