0

I have a database in a dedicated server (CentOS 7) setup by an external provider. I see a disgusting amount of brute-force attempts in MySQL log file every day. I know the best option would be to not connect remotely (and close the port), but I need to.

My IP at home is dynamic but the first 2 bytes are the same. Can I block IPs that are outside of this range? Should this be done for the server in general, or is there a way to do it for MySQL only?

As a note, my provider has access to the server from a static IP, so I would whitelist it, in case my home IP changes and I get locked out.

Improve this question
2
  • 1
    I want to support the recommendation to use "Fail2Ban". I've used it to do the same thing on ssh ports and the brute force attacks dropped from ten's of thousands to near zero.
    – user10216038
    Aug 18, 2018 at 21:23
  • Because I rotate between multiple machines, using public key authentication for SSH is not ideal for servers I frequently access, so I will opt for password authentication. However, I did notice most traffic was probing, so botnets which were likely instructed to open SSH connection root@*.*.*.*:22. As swapping to a nonstandard port helps greatly.
    – safesploit
    Aug 18, 2018 at 22:49

2 Answers 2

Reset to default
2

Can I block IPs that are outside of this range

Absolutely, using iptables you can enforce accepting (whitelisting) of packets from an IP address range or a particular IP address on a particular port. Linux: Iptables Allow MYSQL server incoming request on port 3306

Then you can use Fail2Ban for brute force protection. E.g. if MySQL auth on port 3306 has 3 failed attempts within 5 minutes, close port 3306 for that IP address for 30 minutes.

Although, you can access MySQL externally without the need to expose the port directly to the Internet. Either set up a secure SSH server and tunnel the local port or deploy a VPN to achieve access to the internal network securely. Both will provide you internal access to port 3306, without exposing it to the Internet directly.

Port Forwarding via SSH Tunnelling

Port Forwarding via SSH Tunnelling:

  • (Client)===(SSH Tunnelling)---(MySQL Server)

The same idea is established with a VPN:

  • (Client)===(Secure VPN)---(MySQL Server)

Equals (=) are used to indicate encrypted traffic over the Internet, while the hyphen (-) indictes traffic within your internal network.

Improve this answer
2
  • I just setup Fail2ban and it seems to work great in my case. The tunnel and VPN alternatives sound good as well. Thanks.
    – Jk33
    Aug 18, 2018 at 22:07
  • Glad I could help. Do bear in mind the limitations of Fail2Ban, like iptables it will ban per IP address rather than closing the port for all IP addresses. So, after 3 failed attempts, Fail2Ban will close that port for that particular IP address for 30 minutes. However, if you brute force from multiple IP addresses (say 10 SOCKS proxies/VPNs) and write a script to rotate between them as connections are refused you essentially can go from 3 attempts/30min to 3*10 attempts/30min.
    – safesploit
    Aug 18, 2018 at 22:43
0

fail2ban is configurable. You can lock the ip for 60 minutes or any wanted time interval.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .