I'm getting a ton of these [Warning] IP address errors

WebHostPro

Well-Known Member
PartnerNOC
Jul 28, 2002
1,721
27
328
LA, Costa RIca
cPanel Access Level
Root Administrator
Twitter
Just checking my mysql log files and saw a bunch of these

2019-12-06 15:34:43 2204985 [Warning] IP address 'xxx.xxx.xx.xxx' could not be resolved: Name or service not known
2019-12-06 15:34:43 2204987 [Warning] IP address 'xxx.xxx.xx.xxx' could not be resolved: Name or service not known

I saw the other thread similar but it doesn't help explain what these are from or how to stop them. Which leads to my question.

With port 3306 blocked why is MySQL checking a bunch of IPs?
 

cPanelLauren

Product Owner
Staff member
Nov 14, 2017
13,304
1,252
313
Houston
Hello,

For starters, you might ensure that you do in fact have MySQL access blocked as it is sounding like that is not the case, you may also want to look at binding MySQL to 127.0.01 but this will completely prevent remote users from being able to connect. This issue occurs when MySQL does a reverse lookup on every IP that attempts to connect to the database for any [email protected] user that may exist. This alone wouldn't let anyone in as MySQL subsequently perform a forward lookup to ensure that the provided domain does resolve to the IP procured in the reverse lookup.
 

cPanelLauren

Product Owner
Staff member
Nov 14, 2017
13,304
1,252
313
Houston
Hello,

How have you blocked it? Do you have a firewall rule set explicitly in iptables? On most servers as soon as MySQL is installed 3306 is opened. What's the output of:

Code:
iptables -L -n -v |grep 3306
You can also try scanning the port: from an outside source run the following to the server which you have MySQL on:

Code:
sudo nmap -sU -sT <IPAddress> -p 3306