LogWa

Tag: database

  • Setup fail2ban for MariaDB or Mysql running in Docker container

    Install fail2ban

    • Prevent hacker brute-force into server by public IP and public port
    • Run these command to install fail2ban
    sudo apt install fail2ban
sudo systemctl enable fail2ban --now
sudo systemctl status fail2ban
sudo fail2ban-client status
sudo fail2ban-client status sshd
sudo fail2ban-client status mysqld-auth

    Expose database logs from container to host machine disk

    • check existing logs in Docker container docker logs some-mariadb-container-name
    • map custom cnf folder to MariaDB/Mysql Docker volume according to https://hub.docker.com/_/mariadb
    • see a complete list of available mariadb config.cnf options, just run docker run -it --rm mariadb:latest --verbose --help
    • add this line to your docker-compose.yml or portainer volumes: - /home/ubuntu/mariadb/cnf-folder:/etc/mysql/conf.d
    [mariadb]
log-basename=master1
log-warning=2
expire-logs-days=30
    • log will wirte to disk at /home/ubuntu/mariadb-mysqldata/master1.err
    • sudo vi /home/ubuntu/mariadb-mysqldata/master1.err check running logs
    • restart mariadb container

    Add mariadb or mysql to fail2ban jail

    • sudo vi /etc/fail2ban/jail.local
    [mysqld-auth]
enabled   = true
port      = 58968
filter    = mysqld-auth
logpath   = /home/ubuntu/mariadb-mysqldata/master1.err
findtime  = 3600
maxretry  = 2
bantime   = 86400
    • restart service sudo systemctl restart fail2ban.service
    • sudo fail2ban-client status
    • sudo fail2ban-client status mysqld-auth