Tell me more ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.
up vote 1 down vote favorite

I have a strange situation here:

From time to time I cannot log in with any of my mysql users. I even cannot make a mysql dump.

So I started searching in mysql files and I found that users.MYD and users.MYI are modified in the time when the login problem occurs. The only way to return everything to work is to restore the users.* files from the time when the system was running okay.

I searched about the problem and I found that there was some bug in the MySQL, but it was in the older versions (4.X). I'm running 5.5.

Any ideas? Thanks!

share|improve this question
Next time you can login as root@localhost, run this query and tell the result: select count(1) from information_schema.columns where table_schema='mysql' and table_name='user'; – RolandoMySQLDBA Apr 15 at 15:48
What version of 5.5 are you running? – Michael - sqlbot Apr 16 at 1:51
Its Windows Server 2008. I looked up the logs, there is nothing strange.<br /> All users have passwords.<br /> I looked up in the MYD file and strange thing happens there.<br /> Sometimes the passwords are reversed.<br /> Yep, sound strange but I have copy of the MYDS before the problem and I see the same hashed password but in reverse.<br /> @RolandoMySQLDBA, this can't happen.<br /> I cannot run any query, because I cannot use any user, even root. – Paul Reed Apr 16 at 9:55
The answer to "what version are you running?" is found with SHOW GLOBAL VARIABLES LIKE 'version'; – Michael - sqlbot Apr 17 at 6:07
Sorry for the answer again, I can't add comment.<br /> @Michael - sqlbot, I mean that the server is using Windows Server 2008, the MySQL is 5.5.20. RolandoMySQLDBA, thank you. :)<br /> But it seems that this is not an option in my case.<br /> I have about 10-15 mysql users which are used by software I write.<br /> Changing the root password wont help me restoring the other users password, yes I can reset it that way, but can't restore.<br /> I was thinking about someone hacking me, but in the log there are no external connections.<br /> And my logic is like that: "If someone knows some of the – Paul Reed Apr 17 at 6:27
show 1 more comment

migrated from stackoverflow.com Apr 15 at 12:29

1 Answer

up vote 0 down vote

Theres not enough information here to say with any certainty, but this could very well be that your server has a vulnerability somewhere that is being exploited - someone got access to that file, sets the password for all the users to something so they can then gain access to the database. I would look into your server logs and see if anything weird has been going on.

share|improve this answer
Which logs would you reccomend to look? – Paul Reed Apr 15 at 10:12
Assuming it's a ubuntu server, I would start in /var/log/apache2/*.log and check the access and error logs particularly and look for anything that looks like a hack attempt. Then I would turn on mysql query logging if it's not already and see if any weird queries are being run – dave Apr 15 at 20:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.