Shieldlist

mariadb Gratuit

Connexions refusées dans le journal d'erreurs de MariaDB ou MySQL.

Télécharger le pack tar.gz des fichiers listés ci-dessous

À propos de ce pack

Refused logins from MariaDB's or MySQL's error log (/var/log/mysql/error.log). Category mysql.

On most hosting machines the database listens on the loopback only, and this parser will never match a thing — deliberately, because it requires the host part of 'user'@'host' to look like an address, and 'x'@'localhost' is a local service with the wrong password rather than an attacker.

That is worth keeping rather than deleting: shield stats prints every rule's hit count, so a rule reading 0 hits is a visible statement that this door is shut. The day someone opens 3306 to the world, it starts working with no change.

Parseurs (1)

Les briques : chaque parseur nomme un journal, un préfiltre peu coûteux et la regex qui extrait l'adresse.

mariadb-auth-fail mysql
# A refused database login, from the server's error log:
#   2026-08-13 10:00:01 6516432 [Warning] Access denied for user 'someone'@'203.0.113.9' (using password: YES)
#
# The host part is required to look like an address, which is what
# leaves the local ones alone: 'user'@'localhost' is a service on this
# machine getting its own credentials wrong, not an attack, and there is
# nothing to ban.
#
# NO time_field, deliberately. MariaDB space-pads the hour (" 1:24:55"),
# and Go's time layouts have no verb for that — a format that cannot
# read the log's own timestamps would make every replayed line undated,
# which the dry run reports rather than guessing. Live detection is
# unaffected: a line read now happened now.
parser: mariadb-auth-fail
log: mysql
prefilter: "Access denied for user"
regex: "\\[Warning\\] Access denied for user '(?P<user>.*)'@'(?P<ip>[0-9a-fA-F.:]+)' "

Fichiers