Error establishing a database connection 的解決方法(發現黑客入侵)

今天網站跪了，報這個錯。看起來是數據庫鏈接不上。 先看看數據庫日誌

tail -f /var/log/mysql/error.log
複製代碼

2018-10-11T06:17:01.326500Z 0 [ERROR] InnoDB: mmap(137428992 bytes) failed; errno 12
2018-10-11T06:17:01.326539Z 0 [ERROR] InnoDB: Cannot allocate memory for the buffer pool
2018-10-11T06:17:01.326546Z 0 [ERROR] InnoDB: Plugin initialization aborted with error Generic error
2018-10-11T06:17:01.326558Z 0 [ERROR] Plugin 'InnoDB' init function returned error.
2018-10-11T06:17:01.326566Z 0 [ERROR] Plugin 'InnoDB' registration as a STORAGE ENGINE failed.
2018-10-11T06:17:01.326574Z 0 [ERROR] Failed to initialize builtin plugins.
2018-10-11T06:17:01.327597Z 0 [ERROR] Aborting
複製代碼

能夠看到內存已經不能分配了,爲何會出現這種狀況，繼續看日誌

more /var/log/mysql/error.log
複製代碼

2018-10-10T16:16:44.823992Z 4881 [Note] Access denied for user 'ubnt'@'lith03.synserver.de' (using password: YES)
2018-10-10T16:16:45.459721Z 4882 [Note] Access denied for user 'crc'@'lith03.synserver.de' (using password: YES)
2018-10-10T16:16:46.098390Z 4883 [Note] Access denied for user 'daniel'@'lith03.synserver.de' (using password: YES)
2018-10-10T16:16:46.766732Z 4884 [Note] Access denied for user 'adela'@'lith03.synserver.de' (using password: YES)
2018-10-10T16:16:47.377469Z 4885 [Note] Access denied for user 'backup'@'lith03.synserver.de' (using password: YES)
2018-10-10T16:16:48.006207Z 4886 [Note] Access denied for user 'globalflash'@'lith03.synserver.de' (using password: YES)
2018-10-10T16:16:48.656288Z 4887 [Note] Access denied for user 'postgres'@'lith03.synserver.de' (using password: YES)

2018-10-10T18:38:15.148337Z 4911 [Warning] IP address '58.218.203.20' could not be resolved: Name or service not known
2018-10-10T18:38:15.171867Z 4911 [Note] Access denied for user 'root'@'58.218.203.20' (using password: NO)
2018-10-10T18:38:17.513397Z 4912 [Note] Access denied for user 'root'@'58.218.203.20' (using password: YES)
2018-10-10T18:38:18.942069Z 4913 [Note] Access denied for user 'root'@'58.218.203.20' (using password: YES)
2018-10-10T18:38:19.770001Z 4914 [Note] Access denied for user 'root'@'58.218.203.20' (using password: YES)
2018-10-10T18:38:20.874018Z 4915 [Note] Access denied for user 'root'@'58.218.203.20' (using password: YES)
2018-10-10T18:38:21.358199Z 4916 [Note] Access denied for user 'root'@'58.218.203.20' (using password: YES)
2018-10-10T18:38:21.880487Z 4917 [Note] Access denied for user 'root'@'58.218.203.20' (using password: YES)
2018-10-10T18:38:22.432496Z 4918 [Note] Access denied for user 'root'@'58.218.203.20' (using password: YES)
2018-10-10T18:38:23.159666Z 4919 [Note] Access denied for user 'root'@'58.218.203.20' (using password: YES)
複製代碼

可怕 有人在暴力破解個人數據庫。

查到lith03.synserver.de 這個ip 是德國的 多是租的服務器 可是下面那個58.218.203.20 這個是江蘇蘇州的，不知道是否是vps。 直接訪問也訪問不了。

繼續看日誌

出現了個新的ip 查一下仍是江蘇的。

試着訪問了一下能夠訪問 ,是個hsf 啓動的服務

試着下載了這個 3306結果.rar

打開嚇一跳 全都是數據庫破解後的賬號和密碼

嚇的我趕忙打開防火牆，禁止3306端口

試着訪問了其中幾個ip 的網站 發現不少中招的網站。但願你們趕忙改了數據庫密碼，禁止遠程訪問。可怕！！！

說了這麼多本身的數據庫還要起起來，

修改my.cnf 添加

innodb_buffer_pool_size = 50M
複製代碼

重啓

sudo /etc/init.d/mysql restart
複製代碼

但願你們引覺得戒。作好防禦