Re: SQL Server 2005 - getting Bruteforced

Big thanks to everyone!


David Browne wrote:
"Andreas Kraus" <ak@xxxxxxxxxxxxxxxx> wrote in message news:%23jVhnJWWGHA.4484@xxxxxxxxxxxxxxxxxxxxxxx
Hi and thanks for your reply.

The SQL Server is running on an Internet Server with ASP.NET v2 remotely. We are testing several Web Applications there with a Remote Team.

The ASP.NET Applications are using SQL Authentication instead of Windows Authentication. I wouldn't know how to create a Connection String based on Windows Authentication..

The SA Password is pretty strong but those attacks are really annoying.

Is it possible to restrict the SA Account to local connections only?


Here's an example ADO.NET connection string using integrated security.

Data Source=Your_Server_Name;Initial Catalog=Your_Database_Name;Integrated Security=SSPI;

Once you get that, turn of mixed authentication, or at least disable the SA login.

Also in Windows you can block access to IP interface from selected computers, or from all but selected computers. Also you can move SQL Server off of port 1433, and change your connection strings accordingly.

David


.

Relevant Pages

  • connecting to sql remote database
    ... i am able to connect to remote sql server ... using windows authentication. ...
    (microsoft.public.sqlserver.connect)
  • sql server remote connection
    ... > change it to administrator account, i am able to connect to remote sql server ... > using windows authentication. ...
    (microsoft.public.sqlserver.clients)
  • sql server remote connection
    ... i am able to connect to remote sql server ... using windows authentication. ...
    (microsoft.public.sqlserver.clients)
  • RE: Webservice SQL logon fails on production IIS server
    ... The reason why your authentication is failing is becuase you're trying to ... authenticate to a remote source and when using windows auth, ... authenticated to your remote SQL server. ...
    (microsoft.public.dotnet.framework.webservices)
  • Re: SQL Server 2005 - getting Bruteforced
    ... The SQL Server is running on an Internet Server with ASP.NET v2 remotely. ... We are testing several Web Applications there with a Remote Team. ... The ASP.NET Applications are using SQL Authentication instead of Windows ... Here's an example ADO.NET connection string using integrated security. ...
    (microsoft.public.sqlserver.security)