I have a server running with both SSH and MySQL accessible to the public internet. Both run on default ports (22 and 3306).

The ssh server is attacked by bots all the time. This is the output of fail2ban-client status sshd after about two weeks:

Status for the jail: sshd
|- Filter
|  |- Currently failed: 1
|  |- Total failed:     1491
|  `- File list:        /var/log/auth.log
`- Actions
   |- Currently banned: 697
   |- Total banned:     697

The log for the MySQL server after the same time:

Status for the jail: mysqld-auth
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     3
|  `- File list:        /var/log/mysql/error.log
`- Actions
   |- Currently banned: 1
   |- Total banned:     1

Why is the MySQL server not also attacked? Are attackers simply not interested in database access?

  • 1
    Gaining SSH access is obviously way "better", and you can possibly automate whatever you want to do with the SSH access. Sep 30, 2018 at 12:42

1 Answer 1



1) Most RDBMS (including MySQL) don't instrinsically support client connections or access to a shell to start a new client (limiting malware's ability to spread)

2) Most people don't expose their DBMS on the internet

  • #2 above for the win! Oct 1, 2018 at 1:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.