I have a MariaDB 10.2.14 server running on a CentOS server (10.0.0.201) and a jobs server with various Java processes running on another CentOS server (10.0.0.193). MariaDB is configured such that the root user can only connect from localhost - the various job apps have their own users to connect with.
One of the jobs is currently running and takes quite a while - it moves a lot of data using an insert-select statement. If I do a
show processlist in the database it tells me the connection has come from localhost and is running as root:
| 58684 | root | localhost:57486 | db_name | Query | 23420 | Sending data ...
A netstat on the db server shows the connection with that client port is actually established from the jobs server:
netstat -n | grep 57486 tcp 0 0 10.0.0.201:3306 10.0.0.193:57486 ESTABLISHED
There is no job running on the DB server (it doesn't even have Java installed). Other connections from the job server show as I'd expect - with the remote IP and the application user name. Is anyone able to explain why this might be happening? Is the MariaDB server somehow proxying the remote request? Why would it be running as root?