EMERGENCY - need to secure my server against an ongoing SPAMMER

[Paul Howarth]

Bob Brennan wrote:
> That's what I thought it was too Matthew - since the hosts.frm file
> contains the users and passwords. So I copied all hosts.* files from a
> known good working installation and it made no difference.
> 
> Putting back the old files I noticed the log error was specifically
> "could not *read* hosts.frm" even though it was obviously there and
> obviously valid. I tested my theory on the good working machine by
> renaming hosts.frm - mysqld would not start but the error was "could
> not *find* hosts.frm". Aha! So I started thinking it has to do with
> access rights, disabled SELinux, and hey presto mysqld works again. It
> is obviously an Up2Date change to SELinux that didn't take effect
> until I rebooted, and now I need to narrow down the policy in question
> in order to re-enable SELinux without crippling my databases.

Have you tried relabelling your /var/lib/mysql directory? If you've 
copied in files from other places, they may not be labelled correctly.

# restorecon -R /var/lib/mysql

Paul.