# Manu Access denied for user in logs **URL:** \ **Category:** Percona Server for MySQL 5.7\ **Created:** [January 12, 2019, 4:15am UTC](https://forums.percona.com/t/manu-access-denied-for-user-in-logs/6789 "2019-01-12T04:15:47Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Akuma](https://avatars.discourse-cdn.com/v4/letter/a/ea5d25/32.png) [@Akuma](https://forums.percona.com/u/Akuma)\ **Post date:** [January 12, 2019, 4:15am UTC](https://forums.percona.com/t/manu-access-denied-for-user-in-logs/6789/1 "2019-01-12T04:15:47Z")
Hello, I use a docker image percona:5.7 and today I noticed many “Access denied for user” in logs. Is this normal behavior or someone trying to brutforce my server or something else? Port 3306 is exposed. ```auto 2019-01-12T04:18:53.277786Z 7970 [Note] Access denied for user 'root'@'10.255.0.2' (using password: YES) 2019-01-12T04:18:53.403212Z 7971 [Note] Access denied for user 'root'@'10.255.0.2' (using password: YES) 2019-01-12T04:18:53.537067Z 7972 [Note] Access denied for user 'root'@'10.255.0.2' (using password: YES) 2019-01-12T04:18:53.690169Z 7973 [Note] Access denied for user 'root'@'10.255.0.2' (using password: YES) 2019-01-12T04:18:53.837710Z 7974 [Note] Access denied for user 'root'@'10.255.0.2' (using password: YES) 2019-01-12T04:18:53.995017Z 7975 [Note] Access denied for user 'root'@'10.255.0.2' (using password: YES) 2019-01-12T04:18:54.149238Z 7976 [Note] Access denied for user 'root'@'10.255.0.2' (using password: YES) 2019-01-12T04:18:54.301906Z 7977 [Note] Access denied for user 'root'@'10.255.0.2' (using password: YES) 2019-01-12T04:18:54.422882Z 7978 [Note] Access denied for user 'root'@'10.255.0.2' (using password: YES) 2019-01-12T04:22:51.341862Z 8014 [Note] Access denied for user 'farther'@'10.255.0.2' (using password: YES) 2019-01-12T04:49:17.747239Z 8085 [Note] Access denied for user 'changed'@'10.255.0.2' (using password: YES) 2019-01-12T05:15:52.646675Z 8183 [Note] Access denied for user 'o'clock'@'10.255.0.2' (using password: YES) 2019-01-12T05:42:08.310092Z 8277 [Note] Access denied for user 'passing'@'10.255.0.2' (using password: YES) 2019-01-12T06:07:54.277620Z 8415 [Note] Access denied for user 'girls'@'10.255.0.2' (using password: YES) 2019-01-12T06:33:57.365733Z 8531 [Note] Access denied for user 'force'@'10.255.0.2' (using password: YES) 2019-01-12T06:59:44.990036Z 8656 [Note] Access denied for user 'situation'@'10.255.0.2' (using password: YES) 2019-01-12T07:26:44.448341Z 8807 [Note] Access denied for user 'greater'@'10.255.0.2' (using password: YES) 2019-01-12T07:35:35.284494Z 8860 [Note] Access denied for user 'root'@'10.255.0.2' (using password: YES) 2019-01-12T07:53:19.451639Z 8964 [Note] Access denied for user 'expression'@'10.255.0.2' (using password: YES) 2019-01-12T08:19:40.095796Z 9100 [Note] Access denied for user 'eat'@'10.255.0.2' (using password: YES) 2019-01-12T08:46:47.619866Z 9297 [Note] Access denied for user 'reading'@'10.255.0.2' (using password: YES) 2019-01-12T09:13:22.263099Z 9476 [Note] Access denied for user 'spoken'@'10.255.0.2' (using password: YES) 2019-01-12T09:40:25.689876Z 9639 [Note] Access denied for user 'raised'@'10.255.0.2' (using password: YES) ``` ---
**Author:** ![Akuma](https://avatars.discourse-cdn.com/v4/letter/a/ea5d25/32.png) [@Akuma](https://forums.percona.com/u/Akuma)\ **Post date:** [January 12, 2019, 4:19am UTC](https://forums.percona.com/t/manu-access-denied-for-user-in-logs/6789/2 "2019-01-12T04:19:00Z")
Hello, I’m using a docker image percona:5.7 and today I noticed many “Access denied for user” in container logs. Is this normal behavior or someone trying to bruteforce me or something else? ```auto 2019-01-12T07:35:35.284494Z 8860 [Note] Access denied for user 'root'@'10.255.0.2' (using password: YES) 2019-01-12T07:53:19.451639Z 8964 [Note] Access denied for user 'expression'@'10.255.0.2' (using password: YES) 2019-01-12T08:19:40.095796Z 9100 [Note] Access denied for user 'eat'@'10.255.0.2' (using password: YES) 2019-01-12T08:46:47.619866Z 9297 [Note] Access denied for user 'reading'@'10.255.0.2' (using password: YES) 2019-01-12T09:13:22.263099Z 9476 [Note] Access denied for user 'spoken'@'10.255.0.2' (using password: YES) 2019-01-12T09:40:25.689876Z 9639 [Note] Access denied for user 'raised'@'10.255.0.2' (using password: YES) ``` ---
**Author:** ![IMP](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/imp/32/20213_2.png) [@IMP](https://forums.percona.com/u/IMP)\ **Post date:** [January 14, 2019, 5:03am UTC](https://forums.percona.com/t/manu-access-denied-for-user-in-logs/6789/3 "2019-01-14T05:03:55Z")
Hi, indeed it looks you are being scanned by some host, however, it’s hard to tell which one, as 10.255.0.2 is a private IP address. I’d recommend to check what source IP is trying to scan you on your router/firewall and block it. Moreover, it is advisable to not expose port 3306/tcp on the world, but only to a set of trusted hosts. Best, IMP. ---
**Author:** ![Akuma](https://avatars.discourse-cdn.com/v4/letter/a/ea5d25/32.png) [@Akuma](https://forums.percona.com/u/Akuma)\ **Post date:** [January 14, 2019, 5:13am UTC](https://forums.percona.com/t/manu-access-denied-for-user-in-logs/6789/4 "2019-01-14T05:13:01Z")
Well, I changed the port number to non-standard and there is no more such logs. Thanks. ---
**Author:** ![IMP](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/imp/32/20213_2.png) [@IMP](https://forums.percona.com/u/IMP)\ **Post date:** [January 14, 2019, 12:04pm UTC](https://forums.percona.com/t/manu-access-denied-for-user-in-logs/6789/5 "2019-01-14T12:04:26Z")
Akuma, note, that it doesn’t seem to be a secure solution, as it is relatively easy to get the list of open ports of an instance. Best, IMP.