12

I use Fail2ban on a busy Debian-based database server to secure ssh against brute force attacks, but for performance reasons, I don't want to log every connection from the application server (it would be a big resource hog to read every query to log and parse that by Fail2ban - which is written in Python and is quite slow).

So I'm wondering if there are any built-in mechanisms in MySQL to counter brute-force attacks, or some other tricks to bind MySQL to listen only to particular IP addresses?

P.S. There is a similar question here, but as the answer mainly suggests Fail2ban and iptables, I think my question is not in that vein.

Improve this question
3
  • 1
    Have you tried using certificate authentication?
    – user
    Nov 4, 2020 at 13:42
  • 7
    "...because that will be a big resource hug to read every query to log and parse that by Fail2ban (which is written in Python and is quite slow)." Is this based on actual measurements or just a hunch? You know what they say about premature optimizations...
    – Heinzi
    Nov 5, 2020 at 8:29
  • 1
    Exactly right @Heinzi, honestly if you use Fail2ban you will not have that many connections except for legitimate ones from your applications, and honestly if they use pooling they will not connect /super/ often. If anything is going to be problematic, it will be the size of the log files, not the processing of them in Python.
    – fabspro
    Nov 5, 2020 at 13:10

1 Answer 1

Reset to default
48

The most simple solution would be not to expose MySQL. Usually, MySQL server is accessed only from the same machine, in which case you can set it to listen only on a Unix socket, or on a loopback interface.

If it indeed needs to be accessed from other machines, these are generally just a few ones, in which case you can firewall the port from any host, but those that legitimately need access to it. (Moreover, if all MySQL users are host-restricted, MySQL itself won't allow connecting from hosts different than those).

Improve this answer
6
  • How can I set mysql to listen only on a unix socket, or on a loopback interface ?
    – Babr
    Nov 4, 2020 at 0:41
  • 10
    @Babr That is how MySQL ships by default. To verify though, google how to make MySQL listen to remote connections and do the opposite.
    – Conor Mancone
    Nov 4, 2020 at 0:45
  • 33
    Additionally, I much prefer that my database servers live in private subnets that are not accessible from the internet.
    – Conor Mancone
    Nov 4, 2020 at 0:46
  • 2
    I would disagree that MySQL is usually accessed on the same machine. Either way the OP did say he has a separate application server, so loopback/unix sockets are out. Your firewall suggestion is reasonable.
    – fabspro
    Nov 5, 2020 at 13:12
  • 1
    Fair point @fabspro. I was considering 'small' servers. At the point where people use dedicated servers for mysql, imho they should be on a point to use a private network, not through the internet (which has the added benefit of generally being unmetered).
    – Ángel
    Nov 6, 2020 at 0:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .