MySQL database Brute-force protection

MySQL automatically denies connections from IP address that don't have at least one matching row in mysql.user.  Port 3306 should not be externally accessible (block via iptables/firewall)

"If you are fine with third party tool then you can also use rdbgaurd."

but that one is not for linux right ? that one only say MysQL but should only for MySQL on windows, agree ?

Yes not for Linux.

then can't use it on MySQL on linux. man.

so this means no.

Yes you are correct.

I will have this as condition, or I relies on the IP address list from MySQL to prevent this.

Hi!

As David says here, then to protect you from brute force attacks you should limit the access to your MySQL/MariaDB to the users specific IP addresses or IP address range (domains) and then protect the host using firewall (iptables/firewalld on Linux) and fail2ban

Here is a simple howto on the setup for MySQL brute-force protection using fail2ban.

Regards,
     Tomas Helgi

As David said in his first message, MariaDB/MySQL already build in brute force protection using the GRANT mechanism.

Also, most sites run their LAMP Stack on the same machine, so your Apache + PHP + MariaDB/MySQL all live on the same machine.

If this is the case you can do 100% brute force blocking by adding this to your /etc/mysql/my.cnf (or equivalent).

bind-address       = 127.0.0.1

Select allOpen in new window

Also keep in mind, binding to the related unix domain socket... usually...

socket             = /var/run/mysqld/mysqld.sock

Select allOpen in new window

Gives double or triple (depending on many factors) the throughput of connecting to 127.0.0.1 or any other IP or domain name.

So be sure you create your users relative to localhost + then make your database connections using localhost, rather than IP or domain name.

Skipping the network stack overhead is way slower than sockets.

Use fail2ban and create custom jails for blocking the brute force attacks . Create threshold level as per your requirements.
Fail2ban is integrated with iptables, so once the attacker reaches the threshold the iptable will block him as per the configuration.

David Favor,

"bind-address       = 127.0.0.1"

this says it receive only local host to connect and we use 'bind-address    = 0.0.0.0  ' to accept all connection.

so you assuming that only web on local machine connect to it, right?


"Also keep in mind, binding to the related unix domain socket... usually..."

but this doesn't related to preventing the attack, right?

You'd only use 0.0.0.0 if you really have connections from other machines.

If you do have external connections, then you'd use normal GRANTs to control access.

If someone attempts logging in with some number of incorrect logins, you'd use fail2ban to block these IPs for good.

You have to be clear about what you're asking. If you require no external connections, then you use 127.0.0.1 + you have no issue with attacks.

The only way a person can attack a unix domain socket, is if they're already into your machine + at that point there are no blocks... because, if they're in your machine, then they're in + can do anything.

"You'd only use 0.0.0.0 if you really have connections from other machines.
"

exactly, that's why I said you, by this setting, assumes that all web and DB on the same host.

"If you do have external connections, then you'd use normal GRANTs to control access."

MySQL internal permission right ?

"If someone attempts logging in with some number of incorrect logins, you'd use fail2ban to block these IPs for good."

tks.

"You have to be clear about what you're asking. If you require no external connections, then you use 127.0.0.1 + you have no issue with attacks.
"

but this one still need to concern the Brute-force attack on web server but not DB server, right?

If you're running a CMS like WordPress where all .php files + database are all on one machine, you'd set 127.0.0.1 so no external connections are allowed. With this configuration, all external (off machine/container) connections are blocked. This means with this config, there's no way for any brute force attacks to begin.

If you enable external/offsite connections by setting 0.0.0.0 or some other IP, then you must use the GRANTs table to allow a given user@IP access to connect. This must be done explicitly. You should never just allow any person from any IP to connect.

If you allow, say root@1.1.1.1 this means only IP 1.1.1.1 could possibly create a brute force attack.

You could use fail2ban in this case. Normally fail2ban would be used if you had 100s or 1000s of remote IPs allows (via explicit GRANTs) to access your database.

Rereading your posts, I think you've confused the meaning of 127.0.0.1 (local only) + 0.0.0.0 (external connections allowed).

"This must be done explicitly. You should never just allow any person from any IP to connect.
"
only web server you mean?

usually we do allow all because of internal DB users.

"This must be done explicitly. You should never just allow any person from any IP to connect."

if I want to allow some IP addresses comes in , how can I set it in my.cnf?

tks all,

administrator, please let me awards other contributor, I can't give them score.