Re: Brute Force Attack

Vittorio,

If you use SQL 2005 on a Win2003 server, then the OS security policy can
be configured to allow you to only allow N attempts, then block that IP for
X minutes.

No such luck with SQL 2000 - Microsoft is never going to fix it - the
whole mess started when they released a product with an sa account that
couldn't be deleted or changed with a blank as the default password. This
started a whole industry of nerds breaking into SQL servers. They knew the
account name, and many had blank passwords. Those that didn't, they went
after with a brute force pw attack.

Anyway - what works for me.

Write a 20 line custom program (I use VB .NET but you could use anything)
that is run by the Windows task scheduler every 5 minutes (or whatever). Run
under an admin account. The program does the following

1. Runs netstat -n and dumps the result to a file.
2. Read the file - look for port 1433 - make a list of the ones that are
timing out. Collect the IP numbers of the bad guys.
3. Then run netsh from the custom program to block the IP by adding it to
an existing IP filter list. ie - the command would be (this is for a Win
2003 server)

cmd /c netsh ipsec static add filter filterlist="Block IP Numbers"
srcaddr=CurIP dstaddr=me protocol=ANY mirrored=no

where "Block IP Numbers" is the name of the filter list and CurIP is the IP
you are blocking.

4. Then send an email to yourself from the program
*************************

This is kind of a convuluted way of doing it but it works fine. Why
Microsoft couldn't come up with something more elegant after all these years
is hard to understand. Have fun. - AND - make sure you are using an
impossible sa password - they will never guess it but unless you stop them
they can sure use up a lot of bandwidth trying.

Russ Stevens



.

Relevant Pages

  • Re: SQL account rights
    ... Please advice what is the best, suitable rights rather than domain admin ... issues, such as a server that might have IIS running on the same machine, ... applicable to SQL 2000 environment, ... files, or backups, make sure that the service account has Full ...
    (microsoft.public.sqlserver.security)
  • RE: MP Install issue
    ... Where in the installation are you talking about specifying the account rather ... > MPDB ERROR - CONNECTION PARAMETERS ... > SQL Server Name: servername ... > with a trusted SQL Server connection. ...
    (microsoft.public.sms.setup)
  • Re: SQL Express Fails with Hardware Error
    ... The LocalSystem account is a built-in account, ... which the SQL Service runs. ... MCSE, CCEA, Microsoft MVP - Terminal Server ... Minimum Hardware Requirement (Warning) ...
    (microsoft.public.sqlserver.setup)
  • Re: Replication across non-trusted domains requires Win2k Application server and not Domain Controll
    ... you can do it by using SQL authentication instead of NT authentication. ... that the SQL Agent account on your subscriber has rights to read it. ... Or is it possible to install SQL server ... > upon a Windows 2K Domain Controller(Server with Active directory ...
    (microsoft.public.sqlserver.replication)
  • Re: Replication across non-trusted domains requires Win2k Application server and not Domain Controll
    ... you can do it by using SQL authentication instead of NT authentication. ... that the SQL Agent account on your subscriber has rights to read it. ... Or is it possible to install SQL server ... > upon a Windows 2K Domain Controller(Server with Active directory ...
    (microsoft.public.sqlserver.connect)