MySQL InnoDB的auto_increment值增加2，而不是1.病毒? [英] MySQL InnoDB auto_increment value increases by 2 instead of 1. Virus?
问题描述
有一个InnoDB表，用于存储自定义构建的Web应用程序使用的博客文章的注释.
最近我注意到，注释的自动递增的主键值正在递增2，而不是仅递增1.
我还注意到，在另一个MySQL表中，该表用于记住最后几个评论者的足迹签名(例如ip，会话ID，uagent字符串等)，PHP会话的名称以"viruskinq"开头.这很奇怪，因为我认为它应该始终是类似于md5的十六进制字符串.
Google仅针对土耳其语生成了"viruskinq"的几个结果.有趣的是，大约一年前，该网站被土耳其恶棍污损. (我100％确信，由于我的应用程序中存在任何安全漏洞，攻击者不会成功，因为同一时间由同一公司托管的其他网站也遭到了破坏.)
该网站位于使用Linux的共享主机上.
您是否认为服务器本身仍可能受到那些黑客的影响?检查评论的id值表明，这种加倍现象自今年5月以来就存在，但是这种污损几乎是在一年前发生的.
还有什么其他原因可以解释自动增量值的怪异行为?该应用程序尚未更改，在较旧的注释处，自动递增的主键值是按顺序排列的.
解决方案摘要
托管公司告诉我，自动递增值加倍的原因是因为他们使用主从MySQL架构师，并且根据他们的说法，这种现象很正常.
他们还承认，各种黑客都在不断攻击他们的服务器，尤其是会话"攻击.他们对此无能为力.我认为我最好开始整理自己的东西，并转移到更好的Web主机上.
我真的非常怀疑这是一种病毒.仔细检查该字符串是否真的是会话ID (这确实是引起关注的原因).我的猜测是，这是一个小孩，他发现了如何在浏览器中更改 User Agent 字符串，并且您看到的结果是完全无害的.
关于增量问题.
-
首先，检查 mySQL服务器的
auto_increment_increment设置.也许出于某种原因将其设置为2? -
第二，如果不是那样，我将查看注释系统在表上运行的所有
DELETE操作.被识别为垃圾邮件的评论会被删除吗?您可以记录删除一段时间，还是切换到软删除? -
此外，尝试自己创建一些后续注释.是否会出现相同的现象?如果您使用mySQL手动添加记录怎么办?
-
在PHP代码中仔细查看插入的提交的注释，以确保没有任何东西可以导致此行为.
-
尝试将评论系统移至其他服务器(最好是本地服务器，也许是新设置的服务器)，以查看行为是否在那里仍然存在.
There's an InnoDB table for storing comments for blog posts used by a custom built web application.
Recently I noticed that the auto incremented primary key values for the comments are incrementing by 2 instead of just 1.
I also noticed that in another MySQL table which is used for remembering the last few commenter's footprint signature (e.g. ip, session id, uagent string, etc) the name of the PHP session starts with "viruskinq" which is weird because I thought it should always be a hexadecimal md5-like string.
Google yields only a couple of results for "viruskinq", all in Turkish. It is interesting because approximately a year ago the website in question was defaced by Turkish villains. (I'm 100% sure that the attackers didn't succeed because of any security holes in my app, because other websites, hosted by the same company, were defaced too at that time.)
The site is on a shared host, using Linux.
Do you think it is possible that the server itself may still be under the influence of those hackers? Examining the comment's id values revealed that this doubling phenomena exists since this May, but the defacing happened almost a year ago.
What other causes could there be that explain the weird behavior of the auto increment value? The application hasn't been changed and at older comments the auto incremented primary key values are in order.
Edit: Summary of the solution
The hosting company informed me that the reason of the doubled auto increment value is because they use a Master-Slave MySQL architect and according to them this phenomena is normal.
They also admitted that various hackers are constantly attacking their servers, "especially the sessions" and they cannot do anything about it.
I think I better start packing my things and move to a better webhost.
I really, really doubt this is a virus. Double-check whether that really is the session ID that starts with that string (which would indeed be reason for some concern). My guess would be this is a kid who discovered how to alter the User Agent string in the browser, and you are seeing the results of that, which is entirely harmless.
In regards to the increment problem.
First, check the
auto_increment_incrementsetting of your mySQL server. Maybe it was set to 2 for some reason?Second, if it's not that, I would look at all
DELETEoperations that the comment system runs on the table. Do comments recognized as spam get deleted? Can you log deletions for a while, or switch to soft deletions?Also, try to create some subsequent comments yourself. Does the same phenonmenon occur? What if you add records using mySQL manually?
Look through the PHP code inserting a submitted comment making really sure there is nothing that could lead to this behaviour.
Try moving the comment system to a different server - preferably a local one, maybe freshly set up - to see whether the behaviour persists there.
这篇关于MySQL InnoDB的auto_increment值增加2，而不是1.病毒?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
