Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

Checking my SQL Server log I see several entries like this:

Date: 08-11-2011 11:40:42
Source: Logon
Message: Login failed for user 'sa'. Reason: Password did not match for the login provided. [CLIENT: 56.60.156.50]
Date: 08-11-2011 11:40:42
Source: Logon
Message: Error: 18456. Severity: 14. State: 8.


Date: 08-11-2011 11:40:41
Source: Logon
Message: Login failed for user 'sa'. Reason: Password did not match for the login provided. [CLIENT: 56.60.156.50]
Date: 08-11-2011 11:40:41
Source: Logon
Message: Error: 18456. Severity: 14. State: 8.

And so on.. Is this a possible attack on my SQL Server from the Chinese???! I looked up the IP address at ip-lookup.net which stated it was Chinese.

And what to do?

  • Block the IP adress in the firewall?
  • Delete the user sa?

And how do I protect my web server the best?!

Thanks in advance!

share|improve this question
6  
Employ professionals. I'm sure you have bigger holes to worry about. Closing port 143x is rearranging deckchairs on the Titanic... –  gbn Nov 8 '11 at 14:40
    
I started out by giving the user sa a very complex password and renaming it. Then I'll see what I can do with the firewall.. –  Behrens Nov 8 '11 at 15:28
4  
I think the nationality and geographic location of the people trying to log in to your unprotected database is not the first thing to be checking –  Colin Pickard Nov 9 '11 at 12:19
add comment

5 Answers

up vote 28 down vote accepted

If you have a firewall, why is the database server exposed to the internet?

  • The firewall should block all access to BOTH servers apart from the ports required. Typically this would be 80 (http) and 443 (https) to the web server ONLY.
  • If (and only if) an external service requires access to the SQL Server, permit access to the specific IP addresses required at the firewall. This should occur via a VPN connection, not openly exposed 1433.
  • Create a new administrator account and disable the default 'sa'.
  • Preferably, switch from using "mixed mode" authentication to windows accounts.
share|improve this answer
add comment

First thing you should do is report this to the person responsible for network and systems security at your company. If there is no such person, throw this to the network administrator. If there is no such person, call the CIO/CTO right now -- better yet, demand a face to face -- and explain the situation.

The first thing that person should do is block the IP from the firewall. This will buy you a little time, but not much, maybe minutes only. If the IP maps to a range of IPs as reported by WhoIs.net, block the entire IP range given by WhoIs. That will prevent the guy from requesting a new IP from his ISP and getting in with a new IP. For a few minutes, maybe.

Then do what Mark-Storey Smith says above.

Then either add a firewall or move the db from the DMZ. If you already have a firewall and the db is not in the DMZ, you need an immediate forensic check to see if intervening servers between you and the firewall have been compromised (most likely they have). Change ALL admin password to very long complex passwords -- sa, Windows Admin, domain admins, local admins, ALL OF THEM. Then review every server everywhere on your network and delete any admin accounts you don't recognize or any for former employees or consultants that have left the company. Then virus and malware scan everything on every server.

Then make a second pass and check all of the above again one more time.

Good luck.

share|improve this answer
2  
Chances are pretty good that the person attacking the server is not sitting in front of his computer trying one password after another. It's probably a distributed botnet just looking for holes. This type of attack is common for every kind of service you expose on the Internet. So the first step is not to block a single IP, but to change the admin password and username. If it's a good password, that simple step will buy you years, not minutes. –  Phil Nov 8 '11 at 18:08
add comment

You should not have any of your servers on the public Internet without having a firewall blocking ALL network access from the Internet to the SQL Servers. If you've got port 1433 open what other ports to do have open? My guess would be that you've got lots of ports open to the Internet and if that's the case you probably have people using your SQL Server for things that you don't want them to.

You need to bring in a professional to look at the systems and get your security fixed ASAP. God only knows if people have successfully broken into the system or not. (Yes I'm a consultant, yes I can do the work, no I'm not saying that you have to hire me.)

At the very least you need to read up on network security and database security (I even have a book on the subject) and get your systems secured.

The steps you basically need to follow at this point are...

  1. Setup your firewall to block all inbound connections except those that you actually need
  2. Do a VERY good virus scan of the SQL Server. If you don't already have a virus scanner installed on the SQL Server, assume that it's infected and format the machine.
  3. Setup the database security following best practices: strong passwords, least permissions, etc.
  4. Do a virus scan of every other server at the company. If they don't have virus scanners already installed assume they are infected and format them.
share|improve this answer
    
The problem is, that I really dont know which inbound connections I need, and my budget doesnt allowe me to hire a pro. --- I'm using my server as a mailserver as well, which makes me need the pop3, imap and smtp ports. I am using FTP to upload my webpages, MSSQL as SQL server and PLESK are installed (including HORDE webmail). --- That is basically my setup. -- I have renamed and disabled the SQLs SA acc and renamed the Windows Administrator acc. –  Behrens Nov 9 '11 at 14:36
    
My firewall settings are: oltm.dk/x/settings.jpg -- My inbound rules are: oltm.dk/x/inbound.txt -- My outbound rules are: oltm.dk/x/outbound.txt -- Maybe you help me check the settings and remove the rules which are not needed? --- The rules listed are ONLY the ones that are enabled. All disabled are not shown (they arent active anyway?) –  Behrens Nov 9 '11 at 14:37
    
@erizias if you need help setting up your firewall, you may get better answers on Super User or possibly Server Fault or maybe even Information Security –  jcolebrand Nov 9 '11 at 16:07
add comment

Block all connections to your database which don't originate from your web server(s). Really.

share|improve this answer
    
How do I do this? :) –  Behrens Nov 8 '11 at 12:50
    
currently SQL Server cannot do this. You will have to depend on a Firewall or Windows to do this. See this blogs.msdn.com/b/sql_protocols/archive/2006/04/10/572605.aspx –  D K Nov 30 '11 at 18:20
add comment

In addition to configuring the firewall to block unauthorized traffic, don't forget to add your windows account to the sysadmin role and DISABLE the SA account! Disable SQL authentication as well.

share|improve this answer
2  
Only disable SQL authentication if your applications aren't using SQL authentication. –  mrdenny Nov 8 '11 at 21:04
2  
Yes, mrdenny, that goes without saying. But they shouldn't be using SQL authentication in the first place, unless they are connecting from a non-microsoft network. –  datagod Nov 9 '11 at 5:28
1  
I disagree. There are lots of valid reasons to be using SQL auth. –  mrdenny Nov 9 '11 at 17:23
1  
I renamed and disabled the SA account, but i hope to be able to stay with the SQL authentication and block everything in the firewall except for my static IP adress.. –  Behrens Nov 9 '11 at 17:26
1  
mrdenny, I am not trying to be argumentative, just trying to learn more about what you are saying. Can you link to an article somewhere that shows the valid reasons? The only one I can think of is having an application connecting from a non-microsoft network. Thanks. –  datagod Nov 9 '11 at 18:21
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.