MySQL Brute-Force Protection

• MySQL brute-force protection overview
• How to enable and configure MySQL brute-force protection

RdpGuard protects your MySQL server from dictionary-based brute-force attacks.

It monitors failed MySQL login attempts and blocks the source IP address when the number of failures reaches the configured limit.

Choose Application Event Log or MySQL General Log, depending on where your MySQL server records failed connections. RdpGuard must run on the Windows computer hosting the MySQL server.

1. Open RdpGuard Dashboard and click MySQL under Monitored protocols.

   

2. Select Enable MySQL protection, choose a monitoring method and configure it as described below. Then click Save.

   

Monitoring method

• Application Event Log
• MySQL General Log

Monitoring via Application Event Log

This is the default method and is recommended when MySQL writes failed login attempts to the Windows Application log. It avoids reading the general query log and does not require a configuration-file or log-file path in RdpGuard.

In MySQL 8.0, Windows Event Log output must be enabled explicitly. See the MySQL instructions for MySQL 8.0 or MySQL 8.4.

In Event Viewer, Windows Logs, Application, check that failed connections produce events with source MySQL, event ID 100 and a message containing Access denied for user. These are the events RdpGuard monitors. Selecting this method does not enable MySQL logging automatically.

Multiple MySQL instances on the same computer can be monitored through the shared Application log, provided each instance writes these events.

Monitoring via MySQL General Log

Use MySQL General Log when failed connections are recorded in a general log file instead of the Windows Application log. This method may be slower on heavily loaded servers and monitors one general log file.

Enable MySQL general logging with log-output=FILE, then select MySQL General Log in RdpGuard. Logging only to a MySQL table is not sufficient.

Automatically detect config file location

When automatic general-log discovery is enabled, RdpGuard reads the log location from my.ini or my.cnf. It searches for the configuration file under %PROGRAMDATA%\MySQL.

If the file is elsewhere or several configuration files are found, clear Automatically detect config file location and select the configuration file for the MySQL instance you want to protect.

Automatically detect general log file location

RdpGuard reads general_log_file from the selected configuration file. A relative log path is resolved using datadir.

If the log cannot be found automatically, clear Automatically detect general log file location and select the existing general log file. When you specify the log file directly, RdpGuard does not need the configuration-file path. Click Save to apply the settings.

Check engine status

Open View, Show event log in RdpGuard Dashboard and check for MySQL monitoring errors. If you changed MySQL logging outside RdpGuard, restart the RdpGuard service via Tools, RdpGuard Service, Restart to reload the log settings.

• Application Event Log: check that failed connections appear in the Windows Application log with the source, event ID and message described above. If they do not, configure MySQL event logging or use MySQL General Log.
• MySQL General Log: check that logging to a file is enabled, the file exists and the RdpGuard service can read it. Specify the file path manually if automatic discovery fails.

How to Enable the MySQL General Query Log on Windows