Re: login failed for user 'sa'

From: Jens Süßmeyer (Jens_at_Remove_this_For_Contacting.sqlserver2005.de)
Date: 05/27/05 

Date: Fri, 27 May 2005 23:57:30 +0200

Somethign about auditing:

http://www.microsoft.com/technet/security/prodtech/sqlserver/sql2kaud.mspx

TO identify who is trying to get on your server you have to user a broader
utitlity than the audits in the eventlog, you can use profiler as a SQL
Server based utility ot you use network packet sniffer to determine the MAC
/ Ip Adress for the possible "intruder" 

-- 
HTH, Jens Suessmeyer.
---
http://www.sqlserver2005.de
---
"Martin Rådbo" <news@teknologia.com> schrieb im Newsbeitrag 
news:ui%23jsKvYFHA.2420@TK2MSFTNGP12.phx.gbl...
>A windows 2000 server with MsSql 2000 Standard edition installed. The 
>windows server act as a web server with a few customers.
>
> We have one customer only using the sql server (for a web page).
>
> The problem is a lot of error messages in the event log, they say:
>
> "Event Type: Information
> Event Source: MSSQL$LATITUD
> Event Category: (4)
> Event ID: 17055
> Date:  2005-05-26
> Time:  23:04:37
> User:  N/A
> Computer: IIS1
> Description:
> 18456 :
> Login failed for user 'sa'.
> Data:
> 0000: 18 48 00 00 00 00 00 00   .H......
> 0008: 0d 00 00 00 49 00 49 00   ....I.I.
> 0010: 53 00 31 00 5c 00 4c 00   S.1.\.L.
> 0018: 41 00 54 00 49 00 54 00   A.T.I.T.
> 0020: 55 00 44 00 00 00 07 00   U.D.....
> 0028: 00 00 6d 00 61 00 73 00   ..m.a.s.
> 0030: 74 00 65 00 72 00 00 00   t.e.r...
> "
>
> I am unsure of where to search for the "bad" sa-user, we would appriciate 
> any help.
>
> Regards
> Martin Rådbo
> Teknologia
>
>

Relevant Pages

  • Re: write with cURL
    ... execute permissions. ... This is assuming that the PHP script runs ... of potential security risks from other users on the same server. ... web server itself is part of the group. ...
    (alt.php)
  • Re: Download question
    ... but I'm using a hosting service, the web server is not a server that I have ... >> for the customers to download, but only the customers loged in will be ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: web service architecture question
    ... To assume that we have all the security we will ever need is a bad one. ... ways to breach a server, and the separatin of the web and app server is one ... You can use remoting or web services. ... The web server will be exposed outside the ...
    (microsoft.public.dotnet.framework.webservices)
  • RE: System.Data.SqlClient "Timeout expired" causing ASP.net web applic
    ... There are many values here that can shutdown the aspnet_wp. ... > update tables on a Web Server running SQL Server 2000. ... > formation(DataSet currentBalances): Timeout expired. ...
    (microsoft.public.dotnet.languages.vb)
  • RE: System.Data.SqlClient "Timeout expired" causing ASP.net web applic
    ... There are many values here that can shutdown the aspnet_wp. ... > update tables on a Web Server running SQL Server 2000. ... > formation(DataSet currentBalances): Timeout expired. ...
    (microsoft.public.dotnet.framework.aspnet)