0

We have a Linux box (Ubuntu VERSION="18.04.2 LTS (Bionic Beaver)" that hosts MySQL. When I check the MySQL logs I see constant failed attempts to log in from root@localhost. does this imply that I have malware in the same box or some attacker can pretend to be the localhost?

enter image description here

Improve this question
6
  • 1
    This is what you'll see if some script or process running locally is trying to connect to MySQL as root. By any chance, is there a web server running on this host? If so, is phpMyAdmin running?
    – mti2935
    Commented Sep 2, 2019 at 21:48
  • @mti2935 no there is no other web server. PHPMyAdmin is running but it has its own user. I can see these users under localhost: mysql.session, mysql.sys, phpmyadmin, phpmyadminapp, root
    – Ahmad Mousavi
    Commented Sep 2, 2019 at 21:53
  • 1
    Is PHPMyAdmin accessible remotely over HTTP/HTTPS? If so, try stopping the web server for a few minutes (so that PHPMyAdmin is temporarily unaccessible), and see if that stops the access denied errors in your logs.
    – mti2935
    Commented Sep 2, 2019 at 21:58
  • the brute force has stopped few hours ago, it started from 2019-09-02T15:58:29.461293Z to 2019-09-02T16:20:22.010653Z literally a request per second. could that be PHPmyadmin?
    – Ahmad Mousavi
    Commented Sep 2, 2019 at 22:01
  • 1
    Check your webserver logs. Are you seeing requests to phpmyadmin around the same time that you're seeing the access denied errors that you posted above?
    – mti2935
    Commented Sep 2, 2019 at 22:15

1 Answer 1

Reset to default
1

From our conversation in the comments, it looks like someone (either at the IP that you posted, or proxying through it) may be trying to compromise your system by exploiting your phpmyadmin. If you are not using phpmyadmin, you might want to uninstall it or disable it. If you need it, you might want to follow the steps described here to better secure it.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .