database Free

Password guessing on MariaDB from outside — six refused logins in a minute; the database serves no public client, so this is brute force

Category

database

Threshold

6/1m

Ban policy

attack

Report

database-intrusion

Parsers

mariadb-auth-fail

Why it is written this way

The rule file View raw

# Refused database logins from a real address, six in a minute
# (CrowdSec's mariadb-bf and mysql-bf: capacity 5, leakspeed 10s). The
# parser only matches when the host part of 'user'@'host' is an
# address, so local services getting their own password wrong are not
# counted. The ladder on the database port only: a customer's remote
# client with a stale password keeps its website.
rule: database
description: "Password guessing on MariaDB from outside — six refused logins in a minute; the database serves no public client, so this is brute force"
about:
  purpose: >-
    Keep someone from guessing at your database from the outside.
  blocks: >-
    Six refused logins in a minute from one address, on the database port alone.
  applies_to: >-
    A machine whose MariaDB or MySQL listens beyond localhost.
  requires:
    - >-
      The server's error log, declared as `log: mysql` — /var/log/mysql/error.log on Debian, /var/log/mariadb/mariadb.log elsewhere.
    - >-
      The port declared beside it, so a ban closes the database and nothing else.
  beware:
    - >-
      A customer's client with a stale password is banned on the database port only and keeps its website. Local services getting their own password wrong are never counted: the parser matches only when the host part of 'user'@'host' is an address.
category: database
parsers: mariadb-auth-fail
threshold: 6/1m
ban: attack
report: database-intrusion