RE: "login failed for user ..." appears in event viewer repeatedly

Hi again.

Upon further examination:

The host name changed from bettys to SERVER. The account that was attempted
to logon to was sa. Hundreds of attempts.

A netstat showed continuous connections in a time-wait state to
209.123.180.100, and to changing ports like 5113, 5214, etc., one right after
the other.

While I was working to determine where this was coming from, the attempts
finally stopped.

The Application name used this time was OSQL-32, the client process ID was
3348, and the SPID was 51.

I found one other posting on the net with this same issue with OSQL-32 and
PID 3348, but no solution was posted.

My network is protected by a Cisco PIX.

Any further help to protect the server from future attacks will be greatly
appreciated. Thanks Sean for the suggestions so far.

KT

"KT" wrote:

Thanks Sean.

Looks like our messages went past each other.

Upon further examination, I found I was mistaken about the computer name the
logins are originating from. The user's name is betty and the computer name
that it is coming from is bettys. Upon further examination, I found that this
isn't her computer name, (it was close) and I do not have a computer with
that name on the network. That user is having intermittent lockups using a
certain app that uses SQL. So, I thought that these two were tied together,
but they may be separate issues.

It looks like I am getting hit somehow. I need to figure out where this is
coming from.

Also, I looked closer at the SQL accounts. I do have an sa, but there are
two other accounts that are being tried that I do not have. They are admin
and root.

At this point, I would welcome suggestions on how to pinpoint where this is
coming from, and how to stop it.

Thanks for your help.

KT

"KT" wrote:

Hello again.

I have done some more troubleshooting and I could use some additional
guidance.

I used SQL profiler to audit logins and login failures.

What I found is that one offending computer in the network started trying to
login to SQL, about once per second. The accounts tried were sa, admin and
root. One account would be tried for a few minutes, then it would move to
another account. This went on for about 20 minutes, then stopped.

I have an sa account on SQL along with others. I do not have admin or root
accounts set up. It appears that some exploit is coming the that workstation.

Does this sound correct, and how do I troubleshoot this?

Thanks again for your help.

KT


"KT" wrote:

Hello.

I have messages in event viewer several times per minute that say "Login
failed for user ....". The errors rotate through all the accounts that I have
setup in SQL.

I need direction in how to determine what is trying to login and how to
correct it. Are these attempts to compromise my system?

Thank you for your help.

KT
.

Relevant Pages

  • RE: "login failed for user ..." appears in event viewer repeatedly
    ... then capture sysprocesses every few secs ... I used SQL profiler to audit logins and login failures. ... accounts set up. ...
    (microsoft.public.sqlserver.security)
  • RE: local admin account password
    ... Subject: local admin account password ... > 4) Only use domain accounts so delete the local ones. ... > The DB file would be encrypted with EFS so only the limited user SQL ... > backup user can make a zip backup of the DB whenever it gets changed ...
    (Focus-Microsoft)
  • RE: local admin account password
    ... Say you have more then 1000 systems, how do you handle the local admin ... Only use domain accounts so delete the local ones. ... The DB file would be encrypted with EFS so only the limited user SQL ... There would be basically two stored procs, ...
    (Focus-Microsoft)
  • RE: "login failed for user ..." appears in event viewer repeatedly
    ... OK, did I hear you right, you've determined that the attacks are coming from ... holes to that segment and/or box to just the SQL ports. ... I looked closer at the SQL accounts. ... I used SQL profiler to audit logins and login failures. ...
    (microsoft.public.sqlserver.security)
  • RE: "login failed for user ..." appears in event viewer repeatedly
    ... Upon further examination, I found I was mistaken about the computer name the ... I looked closer at the SQL accounts. ... I used SQL profiler to audit logins and login failures. ...
    (microsoft.public.sqlserver.security)