Service Listening Address

Problem Description

Set up a MySQL server on ECS, firewall and security group are all normal, but cannot be accessed remotely.

Troubleshooting

Check Connectivity

Scanned the server ports using a local computer, results as follows:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

 ⚡yangz ❯❯ nmap -sS MD
Starting Nmap 7.93 ( https://nmap.org ) at 2023-01-26 19:23 China Standard Time
Nmap scan report for MD 
Host is up (0.045s latency).
Not shown: 996 filtered tcp ports (no-response)
PORT     STATE  SERVICE
22/tcp   open   ssh
80/tcp   open   http
443/tcp  closed https
3306/tcp closed mysql

The result indicates port 3306 is open, but the server is not functioning properly.

Check Port

Checked all port usage on ECS:

1
2
3
4

root@minedl:~# netstat -lntp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      24735/mysqld 

MySQL is bound to the localhost loopback address, thus unable to provide external services. That’s where the problem lies.

Binding Address Configuration

MySQL’s default configuration listens to the service address on 127.0.0.1, which does not provide external services. To support remote access, the binding address should be changed to 0.0.0.0 by making the following configuration:

1

vim /etc/mysql/mysql.conf.d/mysqld.cnf

Change the bind-address to 0.0.0.0, note that you cannot just comment it out, otherwise, it will lead to the following second outcome.

1
2
3

tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      24735/mysqld #Only listen to localhost
tcp6       0      0 :::3306                 :::*                    LISTEN      24794/mysqld #Only listen to ipv6, not ipv4
tcp        0      0 0.0.0.0:3306            0.0.0.0:*               LISTEN      24877/mysqld #Listen to all ipv4

The third outcome appears, local access is also successful.

Summary

Many software and frameworks, by default, bind the address to 127.0.0.1, which cannot be accessed from other machines. It needs to be changed to 0.0.0.0 or :::, the former provides ipv4 services, while the latter provides ipv6 services.