Shieldlist

mariadb Free

Refused logins from MariaDB's or MySQL's error log.

Download the pack tar.gz of the files listed below

Rules (1)

About this pack

Refused logins from MariaDB's or MySQL's error log (/var/log/mysql/error.log). Category mysql.

On most hosting machines the database listens on the loopback only, and this parser will never match a thing — deliberately, because it requires the host part of 'user'@'host' to look like an address, and 'x'@'localhost' is a local service with the wrong password rather than an attacker.

That is worth keeping rather than deleting: shield stats prints every rule's hit count, so a rule reading 0 hits is a visible statement that this door is shut. The day someone opens 3306 to the world, it starts working with no change.

The rule

database — six refused logins from a real address in a minute (CrowdSec's mariadb-bf and mysql-bf, © CrowdSec, MIT: capacity 5, leakspeed 10s). Policy database: 1h, then 2h, 4h, 8h, 16h, 25d on a return within thirty days, on the database port only — a remote client with a stale password keeps its website and its mail.

Parsers (1)

The building blocks: each parser names a log, a cheap prefilter and the regex that extracts the address.

mariadb-auth-fail mysql 
# A refused database login, from the server's error log:
#   2026-08-13 10:00:01 6516432 [Warning] Access denied for user 'someone'@'203.0.113.9' (using password: YES)
#
# The host part is required to look like an address, which is what
# leaves the local ones alone: 'user'@'localhost' is a service on this
# machine getting its own credentials wrong, not an attack, and there is
# nothing to ban.
#
# NO time_field, deliberately. MariaDB space-pads the hour (" 1:24:55"),
# and Go's time layouts have no verb for that — a format that cannot
# read the log's own timestamps would make every replayed line undated,
# which the dry run reports rather than guessing. Live detection is
# unaffected: a line read now happened now.
parser: mariadb-auth-fail
log: mysql
prefilter: "Access denied for user"
regex: "\\[Warning\\] Access denied for user '(?P<user>.*)'@'(?P<ip>[0-9a-fA-F.:]+)' "

Reports

database-intrusion This address is guessing passwords on our database server (MariaDB/MySQL), which serves no public client. Repeated refused logins from outside are credential brute force, nothing else. Blocked; please look into the process behind it — a compromised machine or a deliberate attack tool. 
# Categories reuse the mapping proven in production by this host's
# CrowdSec notifier. `include` is empty: a report says what happened,
# never who it happened to. The accounts tried, the mailboxes aimed at
# and the site that was hit are all captured by the parsers and none of
# them are a public database's business.
report: database-intrusion
categories: [brute-force]
says: "This address is guessing passwords on our database server (MariaDB/MySQL), which serves no public client. Repeated refused logins from outside are credential brute force, nothing else. Blocked; please look into the process behind it — a compromised machine or a deliberate attack tool."
include: []

Files