MariaDB ran mysql_secure_installation, but seeing remote login attemps in logs

Question

I installed MariaDB and ran mysql_secure_installation and answered yes to all questions to remove anonymous user, test DB, remote login, etc.

However, I recently had MariaDB crash and in checking the logs I found numerous login attempts of the form:

[Warning] IP address '218.60.8.253' could not be resolved: Name or service not known

Is this normal? To me it indicates that the server is indeed accepting remote connections.

I checked /etc/my.cnf, and did not see the expected bind-address=127.0.0.1 directive shutting down remote login. I have added it manually and restarted the server, but now I am wondering if the mysql_secure_installation did what it was supposed to do.

Is there a way to check that mysql_secure_installation ran correctly?

Answer 1

Yes, the server would still be accepting remote connections. And yes, it probably did what it was supposed to do. mysql_secure_installation doesn't set bind-address=127.0.0.1 neither in MariaDB nor in MySQL. It does however allow you to remove root accounts that are accessible from outside of localhost, as you have already done.

If you don't have any database users with host != localhost, then remote login shouldn't be possible. You can of course also block the MariaDB server port in your firewall.