Re: Is there any way to prevent hacker trying to guess sa password?

From: Ken Schaefer (kenREMOVE_at_THISadOpenStatic.com)
Date: 10/11/05

  • Next message: Rob R. Ainscough: "Re: Is there any way to prevent hacker trying to guess sa password?" 
    Date: Tue, 11 Oct 2005 14:21:05 +1000

    Is is absolutely required that port 1433 be open to the entire internet? If
    not, why not use a firewall or similar to block all IP addresses except
    those that should be permitted access?

    Cheers
    Ken

    "Rob R. Ainscough" <robains@pacbell.net> wrote in message
    news:%23qF1TlhzFHA.2640@TK2MSFTNGP10.phx.gbl...
    : Hi Sue,
    :
    : I don't suppose Microsoft provide any such easy to use tools to monitor
    : "patterned" network traffic -- i.e. the same IP attempting connection with
    : my SQL Server every 10 seconds? Also is there anything in SQL Server 2000
    : that can filter out an IP that attempts more than XYZ failed attempts at
    : login with sa?
    :
    : It seems that 95% of hacker activity/patterns are very similar, but I'm
    not
    : finding anything in the MS 2003 Server nor in MS SQL Server 2000 that
    would
    : help identify and prevent these patterns -- am I just missing something?
    :
    : If not, are there any tools out there (paid or free) that are easy to use
    : with minimal setup -- I'm a developer and don't have the time to spend on
    : tracking stuff like this down and I've got more important task to
    accomplish
    : with looming deadlines.
    :
    : Any recommendation, tips, hints, web sites to visit would be most
    : appreciated.
    :
    : Thanks, Rob.
    :
    : "Sue Hoegemeier" <Sue_H@nomail.please> wrote in message
    : news:3l3mk1hjlkko4ncs8fajt0gn9m2gi3n4m6@4ax.com...
    : > Nothing built into SQL Server 2000 - you have to get at this
    : > through the OS level using Network Monitor or another
    : > sniffer to capture the IP of the source.
    : >
    : > -Sue
    : >
    : > On Mon, 10 Oct 2005 13:01:32 -0700, "Rob R. Ainscough"
    : > <robains@pacbell.net> wrote:
    : >
    : >>Some hacker has set off a program to try and guess the sa password to my
    : >>SQL
    : >>Server that is public (1433 is open) -- I'm logging all the attempts
    : >>(about
    : >>6 a minute from the start of my logging til now -- several 100,000
    : >>combinations and counting.
    : >>
    : >>Is there anyway to detect the source IP and block/shut it down?
    : >>
    : >>Thanks, Rob.
    : >>
    : >
    :
    :

  • Next message: Rob R. Ainscough: "Re: Is there any way to prevent hacker trying to guess sa password?"

    Relevant Pages

    • Re: failed login attempts
      ... but how do you setup profiler to return the PC name or IP ... I have used network monitor and setup a pattern match, which works, ... Microsoft SQL Server doesn't have built-in failed logins auditing ... >> support, including failed login attempts. ...
      (microsoft.public.sqlserver.security)
    • Re: Is there any way to prevent hacker trying to guess sa password?
      ... Nothing built into SQL Server 2000 - you have to get at this ... through the OS level using Network Monitor or another ... sniffer to capture the IP of the source. ...
      (microsoft.public.sqlserver.security)
    • Re: Wrong login IP address
      ... With the current release of SQL Server, ... packet sniffer to get the IP address of the connection with ... the failed login. ...
      (microsoft.public.sqlserver.connect)
    • Offermanager causing excessive SQL traffic
      ... Our SMS 2.0 SP5 server is causing an excessive amount of network traffic to ... When I watch the traffic with Network Monitor I can see that ... otherwise the SQL server is to busy. ...
      (microsoft.public.sms.admin)
    • Re: Connectivity Issues - Bizzare
      ... Sounds like firewall to me. ... >I am trying to connect to a default instance of SQL Server 2000 Enterprise ... I create a SqlDataAdapter on the web form, ... I take the same connection string from the web app, ...
      (microsoft.public.sqlserver.connect)