I have a server running with both SSH and MySQL accessible to the public internet. Both run on default ports (22 and 3306).
The ssh server is attacked by bots all the time. This is the output of fail2ban-client status sshd
after about two weeks:
Status for the jail: sshd
|- Filter
| |- Currently failed: 1
| |- Total failed: 1491
| `- File list: /var/log/auth.log
`- Actions
|- Currently banned: 697
|- Total banned: 697
The log for the MySQL server after the same time:
Status for the jail: mysqld-auth
|- Filter
| |- Currently failed: 0
| |- Total failed: 3
| `- File list: /var/log/mysql/error.log
`- Actions
|- Currently banned: 1
|- Total banned: 1
Why is the MySQL server not also attacked? Are attackers simply not interested in database access?