Re: mysterious MySQL-connect

[Marek Podmaka <marki@onee.sk>]

Hello Andreas,

Friday, September 24, 2004, 12:53:44, you wrote:

> Can you imagine some kind of "code injection" in this case? E.g., an
> HTTP-POST with some "nice" PHP code inside? Well, the web server logs
> don't show up something appropriate, but who knows...?

  hmm... are those db connect attempts periodical or just random? If
  periodical it could be some misconfigured script/program which is
  run from crontab. But from what you have posted it seems more
  random. And look at that error - Got timeout reading communication
  packets. You say there should be no connection to root user from
  that machine? If it's often maybe you will have a luck with tcpdump
  as someone else recommended...

-- 
Best regards,

       .---.        .-----------
      /     \  __  /    ------        Marek 'Marki' Podmaka
     / /     \(  )/    -----
    //////   ' \/ `   ---     e-mail: marki@onee.sk         (preferred)
   //// / // :    : ---               marki@marki-online.net
  // /   /  /`    '--        ICQ UIN: 42698938
 //          //..\\     mobile phone: +421 903 259949
        ----UU----UU---------------------------------------------------
            '//||\\`     "Love makes the world go round." (Proverb)
              ''``
... Hladaj najlepsieho cloveka medzi tymi, ktorych svet odsudzuje. PRISLOVIE