Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

Today, my SQL Server 2008 is attacked by hacker from IP address in China [4300 Login failure in last 7 hours]. I contacted GoDaddy support and below is what they told me.

EXEC sp_readerrorlog 0, 1, 'Login failed' [and result 4300+ failed login and still increasing]

As for the SQL Server brute force attack against your server you would need to determine the best method for resolving that on the server. On some systems the best solution is to simply update the firewall on the server to block access to all connections to the port for SQL Server, 1433, so that only a specific IP can access that port, however the security of your server would be up to you and as such we would not be able to guide you on changing the scope of a windows firewall rule. You may wish to review Microsoft's knowledge base for information on using and modifying the windows firewall on your server.

How can I update the firewall on the server to block access to all connections to the port for SQL Server, 1433, so that only my own IP address can access the SQL Server?

Here is what i have done so far (Next day): I disabled the SA account, since all the attack was on SA username.

I tried to add a inbound rule in firewall for Port number 1433 to block anonymous IP address. I tried to add a inbound rule in firewall for Program(sqlserver.exe) to block anonymous IP address.

but no WIN yet. login failed attempts is continue to increasing. Can someone guide me how to block anonymous IP on the firewall to access the SQL Server.

share|improve this question
    
While you hopefully have a more robust network configuration, see Add or Edit Windows Firewall for one method of doing what the message suggested. –  user2864740 Oct 28 '13 at 17:06
    
Thank you, But can you please share more informative article or any video demo. Specially for this type of issue. Since i am really unfamiliar with firewall. –  user1610100 Oct 28 '13 at 17:16
    
Read the provided link (including the parent topic). Then perform relevant [web] searches using information and keywords and you've recently learned. –  user2864740 Oct 28 '13 at 17:17
    
You can even control it at SQL Server instance level using a LOGON TRIGGER. Refer dba.stackexchange.com/a/37382/8783. –  Kin Oct 29 '13 at 14:59
5  
Why is your database server exposed to the public internet in the first place? –  mustaccio Nov 28 '13 at 14:58
show 1 more comment

migrated from stackoverflow.com Oct 29 '13 at 14:23

This question came from our site for professional and enthusiast programmers.

2 Answers

This really isn't an SQL Server issue - it seems more of a firewall issue.

If you are in a situation where your SQL Servers are directly accessible from dudes in china - I'd be sorting out why no one in your outfit is handling networking/firewalls etc

It sounds quite possible that you need to be worried about more servers than just the one you've noticed getting tickled!

share|improve this answer
add comment

Short of the using outside methods such as network firewalls and ACLs, you can use Windows Firewall on the local machine. I've found just opening the port to be troublesome - plus it does not limit unwanted traffic coming in through that port. I've had success using Program Rules in Windows Firewall.

Start by creating a new inbound rule in Windows Firewall with Advanced Security.

  1. In the New Inbound Rule Wizard, select the "Program" radio button and click Next.
  2. On the next screen, select "This program path:" and enter the location for SQL Server on the machine - for example, %ProgramFiles%\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Binn\sqlservr.exe
  3. Select "Allow the connection" and click Next.
  4. Make no changes on the Users step, click Next.
  5. Leave the default settings on the Profile page, click Next.
  6. On the Name page, enter "SQL Server Connectivity (Program Rule)", and click Finish on the wizard.

Find the rule in the Inbound Rules tab. Open the Properties dialog for the rule and go to the Scope tab. You can stipulate what server IPs, subnets, etc. of computers you want to access the box in the Remote IP address box.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.