Re: Capture IP Address

From: John (IDontLikeSpam_at_Nowhere.com)
Date: 11/21/05

  • Next message: Remus Rusanu [MSFT]: "Re: SQL Server 2005 Service Accounts Questions / Seeking Recommendations" 
    Date: Mon, 21 Nov 2005 11:41:01 -0800

    Hmmm...I apologize if this is a novice observation but I just noticed
    something interesting that I thought I would share...

    I have some MS Access front end databases linked to SQL Server 2000
    databases as the backend (tables) on our internal network. I create new SQL
    logins for every user that requests access to the database and capture every
    user action through SQL Profiler. In analyzing the Profiler trace logs I
    noticed some Login Failed attempts to our Master database which really
    raised my concern. The interesting part is that the Login Failed attempt
    kept saying user 'Admin'. I know that we don't have a specific user name to
    any of our databases named 'Admin' especially to our Master. I just did a
    test and went to open my linked table through MS Access to SQL Server 2000
    and that the Profiler logged the event as a Login Failed attempt to the
    Master database even though the linked table is to one of my other defined
    databases. Then the dsn odbc login pop up comes up and then I log in with
    my valid specified user name and password which is not 'Admin' and am able
    to login successfully. All of the Login Failed attempts with 'Admin'
    throughout my trace logs have a successful login immediately after with a
    valid user name. So it appears that when accessing a SQL Server table
    through a link from MS Access it by default tries to access the Master
    database with the default user name of 'Admin' and then prompts the user for
    the valid login name and password. So maybe these weren't hack attempts
    (which I am truly hoping)?

    Would be interested if someone could confirm to me if this whole process is
    accurate?

    Thanks in advance.

    -J

    "John" <IDontLikeSpam@Nowhere.com> wrote in message
    news:%23pr5wns7FHA.3808@TK2MSFTNGP10.phx.gbl...
    > Keeping up to date with database security can get so stressful makes me
    > sick to gut.
    >
    > Thank you very much Russ for your helpful post. I really appreciate it.
    >
    > -J
    >
    > "Russell Stevens" <rustyprogrammer@online.nospam> wrote in message
    > news:u3mohmk7FHA.3976@TK2MSFTNGP15.phx.gbl...
    >> John,
    >>
    >> If you are getting hack in attempts, just go to the command prompt and
    >> type
    >>
    >> netstat -n
    >>
    >> The SQL attacks will be on 1433 and will be listed as time wait (assuming
    >> you check when you are being hacked).
    >>
    >> Russ Stevens
    >>
    >>
    >
    >

  • Next message: Remus Rusanu [MSFT]: "Re: SQL Server 2005 Service Accounts Questions / Seeking Recommendations"

    Relevant Pages

    • Re: System Administrator Implied Permissions
      ... > sa login, it assigns it the System Administrator fixed ... > Now, given this, why does SQL Server ... in each database is always a member of the public and db_owner roles. ... Other sysadmin role members have the exact same ...
      (microsoft.public.sqlserver.security)
    • Re: No db access after publishing web site
      ... GRANT UPDATE TO ... If I detach and attach this database on a different PC (according that PC ... Cannot open database "pago" requested by the login. ... Are you detaching/attaching the SQL Server Express database correctly ...
      (microsoft.public.dotnet.framework.aspnet)
    • Re: cannot login to the db after...
      ... Jasper Smith (SQL Server MVP) ... I have created a new database, "db_1", using the "sa" ... I then created a new login, "sqluser1" and gave ...
      (microsoft.public.sqlserver.security)
    • Re: Cant view merge agent properties (trying again)
      ... In the List of Actions for the Snapshot Agent History I see this repeated: ... every single database listed. ... So, just now, I went to computername\Administrator Login ID (because it's ... On the computer running SQL Server, ...
      (microsoft.public.sqlserver.replication)
    • Re: Database security design with ASP.net and form-based authentication
      ... Since you already have forms-based security, why not use a single SQL login ... for all database access? ... data entry, guest/view only, admin, report viewer. ... so I'm using SQL Server authentication. ...
      (microsoft.public.sqlserver.security)