 | | | A netwok administration question | A netwok administration question 2003-12-17 - By Keith Mastin
Back
> Hi To All,
>
> I would like to ask how will I know if there are individuals accessing
> mysql database on my server? Is anyone knows this?
>
> I used netstat -anp | grep mysql but I cannot see the ip address of those
> connected which the result is below:
>
> tcp 0 0 0.0.0.0:3306 0.0.0.0:* LISTEN
> 937/mysqld
> unix 2 [ ACC ] STREAM LISTENING 3809 937/mysqld
> /var/lib/mysql/mysql.sock
> unix 3 [ ] STREAM CONNECTED 34239516 937/mysqld
> /var/lib/mysql/mysql.sock
>
> I am confuse with my server security. I am using RH 7.3 and RH 7.2. Any
> help is appreciated.
Looks like it has one connection live to another server process, maybe a
php or perl process? My netstat output is similar (with a lot more
connections) except instead of port 937 it's set to 30919 and firewalled
to keep the database access only through the localhost.
I would recommend though that you set mysqld to listen on a unrestricted
port (1024+) to limit access and to set your packet filter to a DROP
policy and then only allow connections to the server on necessary
restricted ports. It'll help your peace of mind.
HTH
--
Keith
|
|
|