We have a web site hosted on a shared server. The hosting company's MySQL servers are hosted on a different server.
We collect certain kinds of requests through a web form, and write them to a database. Every 10 minutes, cron runs a php script that
- queries a view in the database (no user-supplied or program-supplied parameters),
- emails new requests to us, and
- writes the keys for new requests to another table, effectively removing those rows from the view.
That's the only process running under cron, and cron runs just that one script.
All php database access is through PDO. Inserts use PDO's bindParam.
A single php file contains the connection information for the MySQL server. It's stored outside the web root, I'm the owner, and its permissions are read/write for me alone with no other permissions at all.
Yesterday, I got this error message emailed from cron.
SQLSTATE[HY000] [1130] Host 'somedomain.org' is not allowed to connect to this MySQL server
So far, this is a one-time error. The rest of the time, the php script works as designed.
Neither that domain nor its IP address appear in the web server's log files or in a database dump.
Am I correct in interpreting this as an attempt to crack our server?
Is this configuration good enough to keep our data safe unless my own credentials are compromised?
Later...
The web site for 'somedomain.org' is hosted on the same server our web site's on. If they'd simply made a typo in connecting to their own database, any error message I might see shouldn't have come from cron. This error, coming from cron, seems to be telling me that somehow they're trying to use their credentials, but running my script. Is that right?
Still later...
One of my Google alerts tells me that a content aggregator, 'yetanotherdomain.com' has started scraping data from our web pages. This domain, 'yetanotherdomain.com' is not hosted on the same server our web site's on. But administrative and technical contacts for both 'somedomain.org' and 'yetanotherdomain.com' are registered to the same phone number in the USA.
I looked up the IP address of 'yetanotherdomain.com' using host
. Following up with whois <ip address>
gives me this output (snipped).
network:Street-Address:N/A
network:City:Kiev
network:State:OT
network:Postal-Code:04209
network:Country-Code:UKR