We have a Linux box (Ubuntu VERSION="18.04.2 LTS (Bionic Beaver)" that hosts MySQL. When I check the MySQL logs I see constant failed attempts to log in from root@localhost. does this imply that I have malware in the same box or some attacker can pretend to be the localhost?

enter image description here

  • 1
    This is what you'll see if some script or process running locally is trying to connect to MySQL as root. By any chance, is there a web server running on this host? If so, is phpMyAdmin running? – mti2935 Sep 2 '19 at 21:48
  • @mti2935 no there is no other web server. PHPMyAdmin is running but it has its own user. I can see these users under localhost: mysql.session, mysql.sys, phpmyadmin, phpmyadminapp, root – Ahmad Mousavi Sep 2 '19 at 21:53
  • 1
    Is PHPMyAdmin accessible remotely over HTTP/HTTPS? If so, try stopping the web server for a few minutes (so that PHPMyAdmin is temporarily unaccessible), and see if that stops the access denied errors in your logs. – mti2935 Sep 2 '19 at 21:58
  • the brute force has stopped few hours ago, it started from 2019-09-02T15:58:29.461293Z to 2019-09-02T16:20:22.010653Z literally a request per second. could that be PHPmyadmin? – Ahmad Mousavi Sep 2 '19 at 22:01
  • 1
    Check your webserver logs. Are you seeing requests to phpmyadmin around the same time that you're seeing the access denied errors that you posted above? – mti2935 Sep 2 '19 at 22:15

From our conversation in the comments, it looks like someone (either at the IP that you posted, or proxying through it) may be trying to compromise your system by exploiting your phpmyadmin. If you are not using phpmyadmin, you might want to uninstall it or disable it. If you need it, you might want to follow the steps described here to better secure it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.