I'm getting a ton of these [Warning] IP address errors

[WebHostPro]

Just checking my mysql log files and saw a bunch of these

2019-12-06 15:34:43 2204985 [Warning] IP address 'xxx.xxx.xx.xxx' could not be resolved: Name or service not known
2019-12-06 15:34:43 2204987 [Warning] IP address 'xxx.xxx.xx.xxx' could not be resolved: Name or service not known

I saw the other thread similar but it doesn't help explain what these are from or how to stop them. Which leads to my question.

With port 3306 blocked why is MySQL checking a bunch of IPs?

 

[cPanelLauren]

Hello,

For starters, you might ensure that you do in fact have MySQL access blocked as it is sounding like that is not the case, you may also want to look at binding MySQL to 127.0.01 but this will completely prevent remote users from being able to connect. This issue occurs when MySQL does a reverse lookup on every IP that attempts to connect to the database for any [email protected] user that may exist. This alone wouldn't let anyone in as MySQL subsequently perform a forward lookup to ensure that the provided domain does resolve to the IP procured in the reverse lookup.

 

[WebHostPro]

Don't you need port 3306 to be open to connect to it remotely? We do not have that open for sure. Nothing else was done though.

 

[cPanelLauren]

Hello,

How have you blocked it? Do you have a firewall rule set explicitly in iptables? On most servers as soon as MySQL is installed 3306 is opened. What's the output of:

iptables -L -n -v |grep 3306

You can also try scanning the port: from an outside source run the following to the server which you have MySQL on:

sudo nmap -sU -sT <IPAddress> -p 3306