Remote access forbidden (HY000) to specific mysql client

Question

A MySQL server is located at central.hwcharts.com; it is the master of a basic master-slave replication which replicates toward host0.hwcharts.com, located on a different physical machine which virtualizes (OpenVZ) the VM where the slave runs in.

The replication itself works flawlessly, but the problem is that a mysql-client launched from the "slave" machine cannot connect to the master:

mysql -h central.hwcharts.com -u hwcharts -pvery-long-pass hwcharts
ERROR 2003 (HY000): Can't connect to MySQL server on 'central.hwcharts.com' (111)

The same exact command executed from two other generic machines works OK and successfully connects to the master DB. Details on picture:

                           +-------------------------------------------------------------------------------+
+--------------------+     |                        host0.hwcharts.com                                     |
|central.hwcharts.com|     |-------------------------------------------------------------------------------|
|--------------------|     |                                                                               |
|                    |     |   +-----+      +--------+      +--------------------------------------------+ |
|    MySQL master    |-------->| NAT |--+-->| OpenVZ |--+-->|              MySQL slave host              | |
|                    |     |   +-----+  |   +--------+  |   | MySQL-client cannot reach master from here | |
+--------------------+     |            |               |   +--------------------------------------------+ |
                           |            |               |   +--------------------------------------------+ |
                           |            |               |   |            Another generic VM              | |
                           |            |               +-->|  MySQL-client can reach master from here   | |
                           |            |                   +--------------------------------------------+ |
                           |            |                                                                  |
                           |            |   +-----------------------------------------+                    |
                           |            |   |        Generic physical computer        |                    |
                           |            +-->| MySQL-client can reach master from here |                    |
                           |                +-----------------------------------------+                    |
                           |                                                                               |
                           +-------------------------------------------------------------------------------+

central.hwcharts.com is a rented VPS on its own; host0.hwcharts.com instead maps the IP to my home modem.

MySQL version is 5.5.31 on every machine, for both client and server software.
Operating systems are:

central.hwcharts.com: Debian 6.0.4
host0.hwcharts.com (every OpenVZ VM): Debian 7.1
host0.hwcharts.com (generic computer): Debian 6.0.3

Configuration files:

On master server, /etc/mysql/my.cnf contains:

#
# The MySQL database server configuration file.
#
# You can copy this to one of:
# - "/etc/mysql/my.cnf" to set global options,
# - "~/.my.cnf" to set user-specific options.
# 
# One can use all long options that the program supports.
# Run program with --help to get a list of available options and with
# --print-defaults to see which it would actually understand and use.
#
# For explanations see
# http://dev.mysql.com/doc/mysql/en/server-system-variables.html

# This will be passed to all mysql clients
# It has been reported that passwords should be enclosed with ticks/quotes
# escpecially if they contain "#" chars...
# Remember to edit /etc/mysql/debian.cnf when changing the socket location.
[client]
port        = 3306
socket      = /var/run/mysqld/mysqld.sock

# Here is entries for some specific programs
# The following values assume you have at least 32M ram

# This was formally known as [safe_mysqld]. Both versions are currently parsed.
[mysqld_safe]
socket      = /var/run/mysqld/mysqld.sock
nice        = 0

[mysqld]
#
# * Basic Settings
#
user        = mysql
pid-file    = /var/run/mysqld/mysqld.pid
socket      = /var/run/mysqld/mysqld.sock
port        = 3306
basedir     = /usr
datadir     = /var/lib/mysql
tmpdir      = /tmp
language    = /usr/share/mysql/english
skip-external-locking
#
# Instead of skip-networking the default is now to listen only on
# localhost which is more compatible and is not less secure.
#bind-address       = 127.0.0.1
#
# * Fine Tuning
#
key_buffer      = 16M
max_allowed_packet  = 16M
thread_stack        = 192K
thread_cache_size       = 8
# This replaces the startup script and checks MyISAM tables if needed
# the first time they are touched
myisam-recover         = BACKUP
#max_connections        = 100
#table_cache            = 64
#thread_concurrency     = 10
#
# * Query Cache Configuration
#
query_cache_limit   = 1M
query_cache_size        = 16M
#
# * Logging and Replication
#
# Both location gets rotated by the cronjob.
# Be aware that this log type is a performance killer.
# As of 5.1 you can enable the log at runtime!
#general_log_file        = /var/log/mysql/mysql.log
#general_log             = 1
#
# Error logging goes to syslog due to /etc/mysql/conf.d/mysqld_safe_syslog.cnf.
#
# Here you can see queries with especially long duration
#log_slow_queries   = /var/log/mysql/mysql-slow.log
#long_query_time = 2
#log-queries-not-using-indexes
#
# The following can be used as easy to replay backup logs or for replication.
# note: if you are setting up a replication slave, see README.Debian about
#       other settings you may need to change.
server-id       = 1
log_bin         = /var/log/mysql/mysql-bin.log
expire_logs_days    = 14
max_binlog_size         = 100M
innodb_flush_log_at_trx_commit = 1
sync_binlog         = 1
#binlog_do_db       = include_database_name
binlog_ignore_db    = greatturn
#
# * InnoDB
#
# InnoDB is enabled by default with a 10MB datafile in /var/lib/mysql/.
# Read the manual for more InnoDB related options. There are many!
innodb_file_per_table
#
# * Security Features
#
# Read the manual, too, if you want chroot!
# chroot = /var/lib/mysql/
#
# For generating SSL certificates I recommend the OpenSSL GUI "tinyca".
#
# ssl-ca=/etc/mysql/cacert.pem
# ssl-cert=/etc/mysql/server-cert.pem
# ssl-key=/etc/mysql/server-key.pem



[mysqldump]
quick
quote-names
max_allowed_packet  = 16M

[mysql]
#no-auto-rehash # faster start of mysql but no tab completition

[isamchk]
key_buffer      = 16M

#
# * IMPORTANT: Additional settings that can override those from this file!
#   The files must end with '.cnf', otherwise they'll be ignored.
#
!includedir /etc/mysql/conf.d/

On slave server, /etc/mysql/my.cnf contains:

#
# The MySQL database server configuration file.
#
# You can copy this to one of:
# - "/etc/mysql/my.cnf" to set global options,
# - "~/.my.cnf" to set user-specific options.
# 
# One can use all long options that the program supports.
# Run program with --help to get a list of available options and with
# --print-defaults to see which it would actually understand and use.
#
# For explanations see
# http://dev.mysql.com/doc/mysql/en/server-system-variables.html

# This will be passed to all mysql clients
# It has been reported that passwords should be enclosed with ticks/quotes
# escpecially if they contain "#" chars...
# Remember to edit /etc/mysql/debian.cnf when changing the socket location.
[client]
port        = 3307
socket      = /var/run/mysqld/mysqld.sock

# Here is entries for some specific programs
# The following values assume you have at least 32M ram

# This was formally known as [safe_mysqld]. Both versions are currently parsed.
[mysqld_safe]
socket      = /var/run/mysqld/mysqld.sock
nice        = 0

[mysqld]
#
# * Basic Settings
#
user        = mysql
pid-file    = /var/run/mysqld/mysqld.pid
socket      = /var/run/mysqld/mysqld.sock
port        = 3307
basedir     = /usr
datadir     = /var/lib/mysql
tmpdir      = /tmp
lc-messages-dir = /usr/share/mysql
skip-external-locking
#
# Instead of skip-networking the default is now to listen only on
# localhost which is more compatible and is not less secure.
bind-address        = 127.0.0.1
#
# * Fine Tuning
#
key_buffer      = 16M
max_allowed_packet  = 16M
thread_stack        = 192K
thread_cache_size       = 8
# This replaces the startup script and checks MyISAM tables if needed
# the first time they are touched
myisam-recover         = BACKUP
#max_connections        = 100
#table_cache            = 64
#thread_concurrency     = 10
#
# * Query Cache Configuration
#
query_cache_limit   = 1M
query_cache_size        = 16M
#
# * Logging and Replication
#
# Both location gets rotated by the cronjob.
# Be aware that this log type is a performance killer.
# As of 5.1 you can enable the log at runtime!
#general_log_file        = /var/log/mysql/mysql.log
#general_log             = 1
#
# Error logging goes to syslog due to /etc/mysql/conf.d/mysqld_safe_syslog.cnf.
#
# Here you can see queries with especially long duration
#log_slow_queries   = /var/log/mysql/mysql-slow.log
#long_query_time = 2
#log-queries-not-using-indexes
#
# The following can be used as easy to replay backup logs or for replication.
# note: if you are setting up a replication slave, see README.Debian about
#       other settings you may need to change.
server-id       = 2
#log_bin            = /var/log/mysql/mysql-bin.log
expire_logs_days    = 10
max_binlog_size         = 100M
#binlog_do_db       = include_database_name
#binlog_ignore_db   = include_database_name
#
# * InnoDB
#
# InnoDB is enabled by default with a 10MB datafile in /var/lib/mysql/.
# Read the manual for more InnoDB related options. There are many!
innodb_file_per_table
#
# * Security Features
#
# Read the manual, too, if you want chroot!
# chroot = /var/lib/mysql/
#
# For generating SSL certificates I recommend the OpenSSL GUI "tinyca".
#
# ssl-ca=/etc/mysql/cacert.pem
# ssl-cert=/etc/mysql/server-cert.pem
# ssl-key=/etc/mysql/server-key.pem



[mysqldump]
quick
quote-names
max_allowed_packet  = 16M

[mysql]
#no-auto-rehash # faster start of mysql but no tab completition

[isamchk]
key_buffer      = 16M

#
# * IMPORTANT: Additional settings that can override those from this file!
#   The files must end with '.cnf', otherwise they'll be ignored.
#
!includedir /etc/mysql/conf.d/

Other:

select user,host,password from mysql.user;
+------------------+-----------+-------------------------------------------+
| user             | host      | password                                  |
+------------------+-----------+-------------------------------------------+
| root             | localhost | *non-null-hash-replaced-xxxxxxxxxxxxxxxxx |
| debian-sys-maint | localhost | *non-null-hash-replaced-xxxxxxxxxxxxxxxxx |
| greatturn        | localhost |                                           |
| replication      | %         | *non-null-hash-replaced-xxxxxxxxxxxxxxxxx |
| hwcharts         | %         | *non-null-hash-replaced-xxxxxxxxxxxxxxxxx |
+------------------+-----------+-------------------------------------------+

Maybe the client faces some restrictions due to being executed from the slave host? — davide, Jan 21 '14 at 13:45

score 2 · Accepted Answer · answered Jan 21 '14 at 23:39

2

You need to override the nonstandard port 3307 that you have configured in the [client] section of the slave machine's my.cnf. You are trying to connect to port 3307 on the master, which is configured to listen on 3306, which is why you are getting error 111 - connection refused. Add this to your mysql command line client invocation:

--port=3306

It works from the other machines because they don't have a nonstandard config.

answered Jan 21 '14 at 23:39

Michael - sqlbot

22,658
2
63
86

That was it - nonstandard port. Problem solved :-) – davide Jan 22 '14 at 09:19

score 0 · Answer 2 · answered Jan 21 '14 at 15:32

0

Try specifying a host mask in the GRANT statement like so:

grant ALL PRIVILEGES on hwcharts.* to hwcharts@'host0.hwcharts.com' IDENTIFIED BY 'ultrasecret';

If this doesn't help, providing the output of

mysql> select user,host from mysql.user;

might shed some light on the problem.

answered Jan 21 '14 at 15:32

fuero

9,591
1
35
40

I added the strict host mask as you suggested, then `flushed` privileges. Nothing changed AFAICS. I appended the `mysql.user` table to my first post. – davide Jan 21 '14 at 16:07
Error 111 is never going to be *anything* related to permissions. – Michael - sqlbot Jan 21 '14 at 23:41

Remote access forbidden (HY000) to specific mysql client

Configuration files:

Other:

2 Answers2