Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

Recently i am facing some slow issue for my web application. And i have check my visitor report and it shows normal traffic rate as usual. And then i check my db login auditing and find below login failed logs.

Previously I have enabled remote access (Ms SQL Server > Connection > Allow remote access to this server) for personal purpose. But I have disabled remote access option at the moment but not sure whether it helps.

Does it means someone trying to hack my db? Anything else i can do in order to prevent this?

EDIT

I am getting this kind of errors in random time with each time consists of 100-500 failed attempts(last for 1-2 minutes). Random time for today as below:

01/19/2014 18:41:29
01/19/2014 16:59:44
01/19/2014 15:50:56
01/19/2014 14:59:43
01/19/2014 07:02:33
01/19/2014 05:34:45
01/19/2014 01:25:49

Eg data:

01/19/2014 18:41:30,Logon,Unknown,Error: 18456<c/> Severity: 14<c/> State: 7.
01/19/2014 18:41:29,Logon,Unknown,Login failed for user 'hbv7'. Reason: Could not find a login matching the name provided. [CLIENT: 61.138.99.12]
01/19/2014 18:41:29,Logon,Unknown,Error: 18456<c/> Severity: 14<c/> State: 5.
01/19/2014 18:41:29,Logon,Unknown,Login failed for user 'sa'. Reason: An error occurred while evaluating the password. [CLIENT: 61.138.99.12]
01/19/2014 18:41:29,Logon,Unknown,Error: 18456<c/> Severity: 14<c/> State: 7.
01/19/2014 18:41:28,Logon,Unknown,Login failed for user 'hbv7'. Reason: Could not find a login matching the name provided. [CLIENT: 61.138.99.12]

enter image description here

Most of the errors are login failed for user 'sa'

share|improve this question
4  
Yes looks like a dictionary attack against those accounts. 61.138.99.12 is a Chinese IP address BTW. –  Martin Smith Jan 19 at 13:40

1 Answer 1

Some steps to reduce these vulnerabilities can be found here:

  1. Disable the login that is being attacked. In most cases, the login would be a generic sa or admin account. This will disable access to the account. However, the server may still be vulnerable to outside attacks.
  2. Change name of the account that is being attacked. For instance, change the sa account to sa_databasename in order to make it harder to guess a high level account name.
  3. Change the port from the default 1433 to a random port in order to make it less predictable to find the port that the server is listening to.
  4. Change the firewall settings to only allow know IP addresses to get through the security system.
  5. Implement a strong password policy and make sure that the passwords expire on a frequent basis.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.