CODEWITHSUNDEEP
brute-force
Keith Palmer Jr.
Keith Palmer Jr.

Reputation: 27982

Preventing brute-force attacks on MySQL?

I need to turn on networking for MySQLd, but every time I do, the server gets brute-forced into oblivion. Some mean password guessing script starts hammering on the server, opening a connection on port 3306 and trying random passwords forever.

How can I stop this from happening?

For SSH, I use denyhosts, which works well. Is there a way to make denyhosts work with MySQLd?

I've also considered changing the port MySQL is running on, but this is less than ideal and only a stop-gap solution (what if they discover the new port?)

Does anyone have any other ideas?

If it makes a different, I'm running MySQL 5.x on FreeBSD 6.x.

Upvotes: 5

Views: 2527

Answers (4)

bobince
bobince

Reputation: 536567

I've also considered changing the port MySQL is running on, but this is less than ideal and only a stop-gap solution (what if they discover the new port?)

The stupid bots are the ones that are constantly bashing themselves aginst your port and they don't look for new ports. Move to a different port and you now only have to worry about people who are trying to hack you, rather than the internet background noise of compromised machines scanning random hosts. This is a great improvement.

If you need to let only a few specific machines through to your database you could consider an SSH tunnel between local ports on the database and client machines. It's fairly rare you really want to open a database port to the public internet.

Upvotes: 2

Grzegorz Oledzki
Grzegorz Oledzki

Reputation: 24271

I believe changing the port number from the default one (3306) to some other doesn't improve the security but helps in most cases (at least a bit). Have you tried that in practice or only considered?

Upvotes: 0

Michael Krelin - hacker
Michael Krelin - hacker

Reputation: 143229

Firewall mysql port out. But this belongs to the serverfault realm, I believe.

Upvotes: 4

Citizen
Citizen

Reputation: 12957

Limit the number of unsuccessful requests a single host can make.

Upvotes: 0

Related Questions