Access denied for user 'username_here'@'localhost' showing up in syslog

Community Support Database
1

I haven’t noticed this before, so wanted to share. I have an automated script that runs every week and gives me a break down of health of the server and its services.

It outputs the status of mariadb with this: service mysql status. At the bottom of the output is usually some log entries, which come from /var/log/syslog.

Below is what I started to see on my server. I assume these are local connection attempts on the server, but I don’t recall making any attempts. Is anyone else seeing this in their logs. Is it possibly a process running by hestiaCP that needs to be looked into? I dig some digging but couldn’t figure out what would be calling this.

Jan  5 08:00:49 srv01 mariadbd[1322]: 2025-01-05  8:00:49 3562 [Warning] Access denied for user 'username_here'@'localhost' (using password: YES)
Jan  5 09:36:14 srv01 mariadbd[1322]: 2025-01-05  9:36:14 4465 [Warning] Access denied for user 'username_here'@'localhost' (using password: YES)
Jan  5 09:43:29 srv01 mariadbd[1322]: 2025-01-05  9:43:29 4920 [Warning] Access denied for user 'username_here'@'localhost' (using password: YES)
Jan  5 20:58:18 srv01 mariadbd[1322]: 2025-01-05 20:58:18 8685 [Warning] Access denied for user 'username_here'@'localhost' (using password: YES)
Jan  6 06:47:01 srv01 mariadbd[1322]: 2025-01-06  6:47:01 13291 [Warning] Access denied for user 'username_here'@'localhost' (using password: YES)
Jan  6 06:53:15 srv01 mariadbd[1322]: 2025-01-06  6:53:15 13747 [Warning] Access denied for user 'username_here'@'localhost' (using password: YES)
Jan  6 15:38:16 srv01 mariadbd[1322]: 2025-01-06 15:38:16 17263 [Warning] Access denied for user 'username_here'@'localhost' (using password: YES)
Jan  7 05:23:23 srv01 mariadbd[1322]: 2025-01-07  5:23:23 22802 [Warning] Access denied for user 'username_here'@'localhost' (using password: YES)
Jan  7 18:54:44 srv01 mariadbd[1322]: 2025-01-07 18:54:44 30381 [Warning] Access denied for user 'username_here'@'localhost' (using password: YES)
Jan  7 20:51:15 srv01 mariadbd[1322]: 2025-01-07 20:51:15 31324 [Warning] Access denied for user 'username_here'@'localhost' (using password: YES)
Jan  8 00:16:53 srv01 mariadbd[1322]: 2025-01-08  0:16:53 32925 [Warning] Access denied for user 'username_here'@'localhost' (using password: YES)
Jan  8 23:01:12 srv01 mariadbd[1322]: 2025-01-08 23:01:12 46260 [Warning] Access denied for user 'username_here'@'localhost' (using password: YES)
Jan  9 18:52:53 srv01 mariadbd[1322]: 2025-01-09 18:52:53 59924 [Warning] Access denied for user 'username_here'@'localhost' (using password: YES)
Jan 10 15:48:10 srv01 mariadbd[1322]: 2025-01-10 15:48:10 72248 [Warning] Access denied for user 'username_here'@'localhost' (using password: YES)
Jan 11 06:50:49 srv01 mariadbd[1322]: 2025-01-11  6:50:49 82012 [Warning] Access denied for user 'username_here'@'localhost' (using password: YES)
Jan 11 08:41:15 srv01 mariadbd[1322]: 2025-01-11  8:41:15 82910 [Warning] Access denied for user 'username_here'@'localhost' (using password: YES)
Jan 11 17:13:53 srv01 mariadbd[1322]: 2025-01-11 17:13:53 89278 [Warning] Access denied for user 'username_here'@'localhost' (using password: YES)
Jan 11 17:34:16 srv01 mariadbd[1322]: 2025-01-11 17:34:16 89740 [Warning] Access denied for user 'username_here'@'localhost' (using password: YES)
2

I’m still seeing this appear in the logs. I assume this has to be local on the server and not from external. Anyone else seeing this in your logs? Trying to figure out if it’s something I broke with the Hestia configuration. I don’t believe I’ve made any changes, but perhaps I just didn’t notice it previously. Thanks!

3

I suppose you have some WordPress installed and someone is trying to access to wp-config-sample.php
If you check your logs, you will notice that username_here attempts to connect to your database at the same time someone tries to access yourdomain/wp-config-sample.php

grep -r wp-config-sample.php /var/log/

If you want to avoid having those failed records in your logs, you can remove the wp-config-sample.php file from your WordPress installation. If WordPress is already installed and configured, this file is no longer needed.

1 Like
4

Thank you @sahsanu! I’ve gone and deleted that file on each of my Wordpress sites. Let’s see if that reduces the noise further. Thanks again!

1 Like