-1

Last week end, one of my two webservers was blocked by mysql server. The result is all requests on that blocked webserver show a taylored error page.

I'm thinking to implement a script to prevent this issue. but i can't reproduce this error in my test lab.

Mysql doc says that this error is du to network problems and it is a security implementation to bloc attacks.

Do you have ideas about how to reproduce this error?

i tryed to connect to my test server with wrong login/pwd to simulate a brute force attack. Also i executed a complicated queries which took some minutes to get an answer and stopped it in before getting answer (many time).

I saw variable Aborted_connects increasing but not Aborted_clients and i did't get my host blocked by this test server.

Any idea?

Thank you in advance.

LotfiK
  • 41
  • 7

2 Answers2

2

I know it is old, but i found the way to reproduce it.

First you have to lower down max_connection_error to not repeat yourself:

SET GLOBAL max_connect_errors=2;

then you can use telnet program to make faulty connections. after command just double press enter:

$ telnet 192.168.128.98 3306

Trying 192.168.128.98...
Connected to 192.168.128.98.
Escape character is '^]'.
a
5.6.14-1+debphp.org~precise+1?"sC1kHf?s,{MO$dK-<(Smysql_native_password    
!#08S01Got packets out of orderConnection closed by foreign host.

$ telnet 192.168.128.98 3306

Trying 192.168.128.98...
Connected to 192.168.128.98.
Escape character is '^]'.
a
5.6.14-1+debphp.org~precise+1?"sC1kHf?s,{MO$dK-<(Smysql_native_password

!#08S01Got packets out of orderConnection closed by foreign host.

then you will see your connection refuse:

$ telnet 192.168.128.98 3306

Trying 192.168.128.98...
Connected to 192.168.128.98.
Escape character is '^]'.
kHost '192.168.128.1' is blocked because of many connection errors; unblock with 'mysqladmin flush-hosts'Connection closed by foreign host.
wanis
  • 36
  • 2
  • Hi.Thank you for your answer. I was not able to try the tools suggested above. +1 for the proposed solution :) – LotfiK Feb 10 '14 at 15:40
1

If there are more than this number of interrupted connections from a host, that host is blocked from further connections. You can unblock blocked hosts with the FLUSH HOSTS statement.
If a connection is established successfully within fewer than max_connect_errors attempts after a previous connection was interrupted, the error count for the host is cleared to zero. However, once a host is blocked, the FLUSH HOSTS statement is the only way to unblock it.

Source: http://dev.mysql.com/doc/refman/5.1/en/server-system-variables.html#sysvar_max_connect_errors

Note that the default value in MySQL 5.1.x is set at 10.

EDIT: If you want to try crafting invalid TCP packet hoping that it will generate connect errors in mysql you should look at those two tools:

I suppose it will generate the error you want but I never tried it.

Shadok
  • 623
  • 5
  • 10
  • Thank you for the replay. I did this when i noticed that my webserver is blocked. But my question was how to reproduce this issue? I would like to monitore connection_errors variable in order to avoid a next host blocking. Thank you – LotfiK Feb 10 '12 at 13:35
  • Given what you already tried without success and the doc stating that this error is due to "network problems", you may want to look at crafting your own invalid TCP packets, I'll add details in my question. – Shadok Feb 10 '12 at 14:48