PF with Mysql & Payloads hack

Don't allow access from the internet to your database server, period.

PF is not going to help you as it only works on layer 3/4. You want something above layer 7.
 
Ah ok, and what is recommended to install on the server? Block all traffic outgoing server and accept only local traffic?
 
I've asked this before but we never got a decent answer, what exactly are you trying to protect against?
 
I am sorry, my English is not good because I am from Italy and I don't know much. It is attacked with payloads metasploit for MySQL made by blackhat. I am sure I can block but I don't know which product is good for me. Layer 7? What product do you reccommend?
 
There are currently no known vulnerabilities with MySQL.

In any case, this will solve your problem:
Code: 
block in from any to any port 3306
 
Ok, but that will block all traffic, including the local one? Why does the MySQL server work well at times on some external IP to receive queries and information?
 
Gio01 said:
Why the mysql server works well at times on some external ip to receive queries and information.
Click to expand...
Don't allow access to your database from the internet.
 
Those aren't rules, those are accounts on your database. It's no wonder you keep getting hacked.

I highly recommend NOT using the root account. Create a normal account with just enough privileges to access the data it needs.

As for access from the internet, in /etc/rc.conf:
Code: 
mysql_enable="YES"
mysql_args="--bind-address=127.0.0.1"
And restart MySQL.
 
Yes, I have a different configuration for user. I have forgotten to set up my.cnf. I told you if it fixes my issue.
Thank you.
EDIT:

I put what you said. But to listen to only a certain IP I should enter always:
Code: 
mysql_args = "- bind-address = ip"
?
 
Gio01 said:
I am sorry, my English is not good because I am from Italy and I don't know much. It is attacked with payloads metasploit for MySQL made by blackhat. I am sure I can block but I don't know which product is good for me. Layer 7? What product do you reccommend?
Click to expand...

If you can put another box in front of your server pfSense is very nice.

It's free and will run great on an old box if you happen to have one.
 
As far as I know MySQL on FreeBSD isn't vulnerable. Besides, the patched version has been in the ports for quite some time.
 
You must log in or register to reply here.
Back
Top