Re: Can SQL be told to stop listening on specific IPs on its computer ?

From: Kevin (ReplyTo_at_Newsgroups.only)
Date: 10/16/03

  • Next message: Sue Hoegemeier: "Re: Can SQL be told to stop listening on specific IPs on its computer ?" 
    Date: Wed, 15 Oct 2003 15:09:07 -0700

    if they're on the same machine then use the LPC protocol and shutdown the
    ports on the firewall or in packet filtering on the OS network control
    panel. 

    --
Kevin Connell, MCDBA
--------------------------------------------------
The views expressed here are my own
and not of my employer.
----------------------------------------------------
"Fox" <fox @ connexions .net> wrote in message
news:#gXQhF2kDHA.644@TK2MSFTNGP11.phx.gbl...
> Yes, for now they need to be on the same server.
> Can't get another computer right now. Already have
> 8 of them. Thanks for the in depth explanation, it
> helped to put things in perspective
>
> However, I did solve my problem. I got a copy of
> Exploiter and found that all the attacks were
> coming from the same IP address. Funny thing
> is that when I blocked that address in my
> firewall, SQL server could not be found online
> or by Enterprise. Although it was running in
> services. Anyway, I contaced the ISP who
> has the IP number and they rerouted it so it
> could do no damage while they investigate.
>
> About the server not showing up when I
> blocked the offending IP address. This makes
> me concerned that there was some type
> of a successful hack. Have you any ideas
> on this ? I cannot find anything with Pest Patrol
> Norton or Exploiter.
>
> Regards,
> Fox
>
> "Sue Hoegemeier" <Sue_H@nomail.please> wrote in message
> news:af6rovg8e4hil9se95t86sdfkj57chmo0q@4ax.com...
> > The service actually listens on a port, not an IP. The IP is
> > just the address to the server....something like finding the
> > server at the address <IP> and SQL Server on the port <Port
> > number>. The logs should show:
> > listening on xx.xxx.xxx.xxx: 1433 (or whatever port number)
> > Where the number after the colon is the port number.
> > In terms of 127.0.0.1, that's just the loopback address.
> > In terms of the IPs and the web addresses, do you have IIS
> > and SQL Server installed on the same server?
> >
> > -Sue
> >
> > On Wed, 15 Oct 2003 12:39:01 -0400, "Fox" <fox @ connexions
> > .net> wrote:
> >
> > >I do not remember and cannot find if there is a place
> > >to tell SQL server what IPs and ports to listen on. Does it
> > >require listening on 127.0.0.1 ?
> > >
> > >The logs show it is listening on the IPs which have
> > >web sites on them. Can I limit these? I am under
> > >attack and need to minimize the CPU drain.
> > >
> > >Would an attacker be using 127.0.0.1 ?
> > >
> > >Thanks,
> > >Fox
> > >
> >
>
>
  • Next message: Sue Hoegemeier: "Re: Can SQL be told to stop listening on specific IPs on its computer ?"

    Relevant Pages

    • Re: iptables configuration
      ... >> that if a 'virus/trojan' initiated a connection to the net, the firewall ... >> would not protect the LAN. ... The LAN is NATed with private IPs to one public IP. ... the ports that are used by services running on linux. ...
      (comp.os.linux.security)
    • Re: block_ssh_guessers
      ... True but then, how fat is the pipe, compared to firewall device. ... the knocking host tries ports OTHER THAN the expected ones in the sequence ... checking the IPs being spoofed. ... We pay a bandwidth fee, ...
      (comp.os.linux.security)
    • Re: Should a firewall ONLY allow access to an IP range - as well as blocking ports?
      ... >We do have a firewall but it is set up to let all IPs access the open ... >access on ports we use to administer the server to an IP range only? ... developed a firewall ruleset to block access to those. ...
      (comp.security.misc)
    • Re: Should a firewall ONLY allow access to an IP range - as well as blocking ports?
      ... >We do have a firewall but it is set up to let all IPs access the open ... >access on ports we use to administer the server to an IP range only? ... developed a firewall ruleset to block access to those. ...
      (comp.security.firewalls)
    • Re: Cant replicate between two servers
      ... yes i check to ports in the firewall and it's all opened ... Ping only ... > appropriate permissions to access SQL Server and of course, the ports must ...
      (microsoft.public.sqlserver.replication)