[Snort-users] mysql error prevails...

AllowOverride allowoverride at ...11827...
Sat Oct 6 14:13:30 EDT 2012


ah, the old telnet trick, ok,, here is the results

1.  

ufw status numbered 
Status: active

     To                         Action      From
     --                         ------      ----
[ 1] 192.168.1.14 22/tcp        ALLOW IN    192.168.1.35
[ 2] 192.168.1.14 80/tcp        ALLOW IN    192.168.1.35
[ 3] 192.168.1.14 139/tcp       ALLOW IN    192.168.1.35
[ 4] 192.168.1.14 445/tcp       ALLOW IN    192.168.1.35
[ 5] 192.168.1.14 22/tcp        ALLOW IN    192.168.1.8
[ 6] 192.168.1.14 139/tcp       ALLOW IN    192.168.1.8
[ 7] 192.168.1.14 445/tcp       ALLOW IN    192.168.1.8
[ 8] 3306                       ALLOW IN    Anywhere

2. 
from remote ip 192.168.1.35

telnet 192.168.1.14 3306
Trying 192.168.1.14...
telnet: Unable to connect to remote host: Connection refused

3.

telnet localhost 3306
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
[
5.5.24-0ubuntu0.12.04.1
$V9Z:SoY�]glkUE;5:cbCmysql_native_password^CConnection closed by
foreign host.

hmm interesting, all that data spit out, its open of course.. its
localhost

4. ok, let's try with ufw off (aka iptables)

# ufw disable 
Firewall stopped and disabled on system startup

# service ufw stop
ufw stop/waiting

remotely from 192.168.1.35:

telnet 192.168.1.14 3306
Trying 192.168.1.14...
telnet: Unable to connect to remote host: Connection refused

telnet localhost 3306
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
[
5.5.24-0ubuntu0.12.04.1%BAaEs4F�b at ...15856...%}l&q,&mysql_native_password
^C   Connection closed by foreign host.



suggestions? thanks eric g :)





On Fri, 2012-10-05 at 18:56 -0400, Eric G wrote:
> 
> 
> On Fri, Oct 5, 2012 at 5:50 PM, AllowOverride
> <allowoverride at ...11827...> wrote:
>         Yep: it must be something else: any suggestions??
>         
>         
> 
> 
> Something simple and basic to try... can you try to just 'telnet
> localhost 3306' and see if a socket successfully opens on mysql's
> port?
> 
> 
> --
> Eric
> 
> 





More information about the Snort-users mailing list