0

My website is hosted with Linode, I installed webmin on Ubuntu 14.04 to manage it. Recently my database server keeps shutting down, when I look at /var/log/mysql, there are several log files in there

-rw-r-----  1 mysql adm    14642 Jun 28 07:25 error.log
-rw-r-----  1 mysql adm      264 Jun 27 05:48 error.log.1.gz
-rw-r-----  1 mysql adm      256 Jun 26 02:23 error.log.2.gz
-rw-r-----  1 mysql adm      426 Jun 24 20:19 error.log.3.gz
-rw-r-----  1 mysql adm      295 Jun 24 03:18 error.log.4.gz
-rw-r-----  1 mysql adm      141 Jun 22 15:07 error.log.5.gz
-rw-r-----  1 mysql adm      215 Jun 22 03:38 error.log.6.gz
-rw-r-----  1 mysql adm      345 Jun 21 01:28 error.log.7.gz

Most of the error_log contents are like 

160621  8:34:52 [Warning] IP address '122.114.126.30' could not be resolved: Temporary failure in name resolution
160621 18:41:36 [Warning] IP address '58.221.71.35' could not be resolved: Name or service not known
160621 21:29:02 [Warning] IP address '58.221.42.196' could not be resolved: Name or service not known
160622  1:36:17 [Warning] IP address '121.41.74.27' could not be resolved: Name or service not known
160622  7:38:24 [Warning] IP address '118.192.162.95' could not be resolved: Name or service not known

I read this question but I am not sure whether I understand the answers correctly. Does this mean people from above IP address were trying to login to my database? If they are attacks, what can I do to deal with them or I can just rely on linode to fend off these attacks? And I notice the earliest of these errors were from 6/21, I wonder there are not any error_logs before that date? Or there are, but they are in somewhere else?

Thank you!

Community
  • 1
shenkwen
  • 197
  • 2
  • 12
  • The short answer is yes, all this IP tried to authenticate to your DB, but because there is no reverse lookup address from then you get this messgaes. why is your DB expose directly to the internet ? – Rabin Jun 28 '16 at 12:32
  • because I have very limited knowledge about it. I am not even aware that my DB is exposed. I just use webmin to manage it and everything was almost by default. How do I stop it from exposing? thank you! – shenkwen Jun 28 '16 at 12:36
  • I never used webmin so I don't know how much control you have changing the configuration for your DB. But the basic idea is to bind the process only to 127.0.0.1 or use a unix socket. – Rabin Jun 28 '16 at 12:38

0 Answers0