Shieldlist

mariadb Gratuit

Connexions refusées dans le journal d'erreurs de MariaDB ou MySQL.

Télécharger le pack tar.gz des fichiers listés ci-dessous

Règles (1)

À propos de ce pack

Refused logins from MariaDB's or MySQL's error log (/var/log/mysql/error.log). Category mysql.

On most hosting machines the database listens on the loopback only, and this parser will never match a thing — deliberately, because it requires the host part of 'user'@'host' to look like an address, and 'x'@'localhost' is a local service with the wrong password rather than an attacker.

That is worth keeping rather than deleting: shield stats prints every rule's hit count, so a rule reading 0 hits is a visible statement that this door is shut. The day someone opens 3306 to the world, it starts working with no change.

The rule

database — six refused logins from a real address in a minute (CrowdSec's mariadb-bf and mysql-bf, © CrowdSec, MIT: capacity 5, leakspeed 10s). Policy database: 1h, then 2h, 4h, 8h, 16h, 25d on a return within thirty days, on the database port only — a remote client with a stale password keeps its website and its mail.

Parseurs (1)

Les briques : chaque parseur nomme un journal, un préfiltre peu coûteux et la regex qui extrait l'adresse.

mariadb-auth-fail mysql 
# A refused database login, from the server's error log:
#   2026-08-13 10:00:01 6516432 [Warning] Access denied for user 'someone'@'203.0.113.9' (using password: YES)
#
# The host part is required to look like an address, which is what
# leaves the local ones alone: 'user'@'localhost' is a service on this
# machine getting its own credentials wrong, not an attack, and there is
# nothing to ban.
#
# NO time_field, deliberately. MariaDB space-pads the hour (" 1:24:55"),
# and Go's time layouts have no verb for that — a format that cannot
# read the log's own timestamps would make every replayed line undated,
# which the dry run reports rather than guessing. Live detection is
# unaffected: a line read now happened now.
parser: mariadb-auth-fail
log: mysql
prefilter: "Access denied for user"
regex: "\\[Warning\\] Access denied for user '(?P<user>.*)'@'(?P<ip>[0-9a-fA-F.:]+)' "

Signalements

database-intrusion This address is guessing passwords on our database server (MariaDB/MySQL), which serves no public client. Repeated refused logins from outside are credential brute force, nothing else. Blocked; please look into the process behind it — a compromised machine or a deliberate attack tool. 
# Categories reuse the mapping proven in production by this host's
# CrowdSec notifier. `include` is empty: a report says what happened,
# never who it happened to. The accounts tried, the mailboxes aimed at
# and the site that was hit are all captured by the parsers and none of
# them are a public database's business.
report: database-intrusion
categories: [brute-force]
says: "This address is guessing passwords on our database server (MariaDB/MySQL), which serves no public client. Repeated refused logins from outside are credential brute force, nothing else. Blocked; please look into the process behind it — a compromised machine or a deliberate attack tool."
include: []

Fichiers