Re: SQL Server 2005 - getting Bruteforced


"Andreas Kraus" <ak@xxxxxxxxxxxxxxxx> wrote in message
news:%23jVhnJWWGHA.4484@xxxxxxxxxxxxxxxxxxxxxxx
Hi and thanks for your reply.

The SQL Server is running on an Internet Server with ASP.NET v2 remotely.
We are testing several Web Applications there with a Remote Team.

The ASP.NET Applications are using SQL Authentication instead of Windows
Authentication. I wouldn't know how to create a Connection String based on
Windows Authentication..

The SA Password is pretty strong but those attacks are really annoying.

Is it possible to restrict the SA Account to local connections only?


Here's an example ADO.NET connection string using integrated security.

Data Source=Your_Server_Name;Initial Catalog=Your_Database_Name;Integrated
Security=SSPI;

Once you get that, turn of mixed authentication, or at least disable the SA
login.

Also in Windows you can block access to IP interface from selected
computers, or from all but selected computers. Also you can move SQL Server
off of port 1433, and change your connection strings accordingly.

David


.

Relevant Pages

  • Re: Cannot connect using sa
    ... that's because there isn't generally an advantage to SQL Server ... Windows authentication is significantly more secure. ... >>>from the connection string, couldn't connect, then when I put it back I ...
    (microsoft.public.sqlserver.setup)
  • RE: arghh.. cant get .NET to connect to sql server
    ... When accessing the SQL Server, there are two authentication modes. ... specify the userid and the password in your connection string, ...
    (microsoft.public.sqlserver.security)
  • Re: big performance problem
    ... When your system authenticates to SQL server (i.e. connection string ... > I am using a form authentication turned off right now as I am just testing ... > I am using stored procedure and datareader and also the DB size is very ...
    (microsoft.public.dotnet.framework.aspnet)
  • Windows Authentication connectionstring Login failed for user Gue
    ... authentication to access SQL Server using the sa login. ... sa login, I want to convert the app to use Windows Authentication. ... Then I changed the connection string to: ...
    (microsoft.public.data.ado)
  • Re: SQL Server 2005 - getting Bruteforced
    ... We are testing several Web Applications there with a Remote Team. ... The ASP.NET Applications are using SQL Authentication instead of Windows Authentication. ... Also you can move SQL Server off of port 1433, and change your connection strings accordingly. ...
    (microsoft.public.sqlserver.security)