[Bastille-linux-discuss] Bastille and MySQL

[Reza R. <rez...@gm...>]

Hi all.

We had our web server hardened by the team at dynamicnet.net and they
used bastille and psad in the process.

Ever since we had bastille firewall installed and configured on my
server we have been getting random MySQL connection errors.

Everything runs pretty smoothly most of the time, we can carry lots of
apache/mysql connections without any issues, server has plenty of free
RAM and CPU is never overloaded even during peak hours. I have been
told bastille firewall (iptables) is configured correctly, all ports
that need to be open are open.

But about twice per day we have a MySQL "disconnect" that lasts about
30-60 seconds per incident. For example we will start getting the
following message via e-mail, and it will amount to 20-30 e-mails like
this during the 30-60 second incident. After that, the e-mails and
problems will go away, until next time.  It's almost as if the port is
being shut down for a brief period and then opens back up.

-------
vBulletin Database Error!
mysql_connect(): Can't connect to MySQL server on 'sql.datacolony.com' (4)
/hsphere/local/home/site/site.com/forum/includes/class_core.php on line 274
MySQL Error :
Error Number :
Date : Saturday, January 26th 2008 @ 07:53:05 PM
Script : http://site.com/forum/forumdisplay.php?f=69
Referrer : http://site.com/forum/showthread.php?t=17518&page=19
IP Address : 92.3.190.54
Username :
Classname : vb_database
-------

The server is running CentOS 4.6, PHP 4.4.7, MySQL 5.0.45. The
vBulletin software has been patched to the latest version. The
vBulletin people are not sure why this could be happening.

Well we never believed that the firewall was causing the issue BUT it
only started happening on the day the new firewall was installed. So
we tried stopping the firewall for a full week and the MySQL database
errors stopped happening, completely. So I'm convinced the problem is
the firewall blocking MySQL connections but I can't figure out why?

Also I recently setup a test script to try and connect to a separate
MySQL database every minute.  Every time we have an "incident" as
mentioned above we get a corresponding entry in the test script:
2008-03-05 21:48:01     Connection failed.  Reason: "Can't connect to
MySQL server on 'sql.datacolony.com' (110)"

There are no entries in the MySQL .err logs pertaining to this. Can't
figure this out, any help or ideas is appreciated since the people who
installed the firewall are not sure either.

Thanks.
Reza