Someone hacking my SQL database?

[RogerZF]

OK, my server's not slow. I tested another site that ran on the same server but a different SQL database, and it loaded just fine.

However, one of my bigger sites has been loading INCREDIBLY slow. Sometimes I get a SQL error saying I have too many connections. Just recently, someone posted a hateful remark about my site on my forum and the IP said "127.0.0.1." So I'm obviously expecting someone tried to hack my board, but failed so now they're trying to flood the SQL database.

How do I know if my SQL database is getting hacked? How can I make the SQL database run faster? Is there a way to find the hacker and kill his connections? Any tips would be much appreciated.

[lammert]

and the IP said "127.0.0.1." So I'm obviously expecting someone tried to hack my board, but failed

If the IP is 127.0.0.1, I wouldn't be too sure that the hacking attempt failed. Normally this address is only used when the access is directly from the webserver and it can only be generated by someone accessing the server directly.

Is the server running on Linux and do you have SSH access to the server? Then logon and try ps -ef or ps -aux to see which processes are running. Maybe some background processes of the hacker? Normally when you logon with SSH, the system tells you from which IP address / computer the previous succesful logon attempt was. Check if it was your computer or another.

If you suspect hacking, change all your passwords on the server, i.e. SQL passwords, SSH, FTP etc. See if the slow behaviour stops after you changed them.

[RogerZF]

Well I'm using Invision and one of the posters had the IP "127.0.0.1" Does anyone know of any security holes in Invision Power Board 2.0.3 that might cause this to happen?

[RogerZF]

Sorry I don't know how to edit my post, but, upon further inspection, I found that several users have registered with 127.0.0.1 (the registrations were seperated weeks/months apart so I doubt it was a hack attempt to get the 127.0.0.1 IP). Perhaps it's a bug?

I also noticed that a legitimate user posted once with the 127.0.0.1 IP. His other posts have a different IP though.

Also, something else came to mind. Let's suppose that I was hosting the forum. If I sign on to the forum from the server computer and make a post, wouldn't the IP that gets logged be my public/internet IP rather than the localhost IP?

Thanks.