I have a couple SQL Server Express Databases which are accessible through a number of asp.net/IIS websites plus Remote Desktop (me only). The web sites use integrated security and I have one user account that I use. The problem is the logs show almost continuous attempts at failed logins. These occur every 5-10 seconds or so, from one IP for about 5 minutes, then the IP changes. The user name being attempted is usually 'sa' or some variation (I don't have an 'sa' user). I have blocked several hundred of these IPs using Windows Firewall, but they just keep coming. This results in huge log files and I guess a lot of bandwidth being used. So my question: Do I have enough security in place that I don't have to really worry about this - or is there something more I should be
2
-
1Few interesting discussion Why do sites implement locking after three failed password attempts?– SqlWorldWideCommented Mar 14, 2018 at 17:53
-
Doesn't help much if they try 'sa' and it hurts when your own account get's locked out.– John K. N.Commented Mar 15, 2018 at 8:24
Add a comment
|
2 Answers
If possible, you should change your security approach to be denied by default, allowed by permission.
Block access from all unknown IP's. Allow access from trusted IP's.
Absolutely yes.
The failed logon attempts mean that someone/something at least has access to the IP/Port and your server might be facing the internet.
It's not the failed logon attempts that you should worry about as much as the successful ones you might not notice.
You are also exposing yourself to DoS attacks and increasing the attack surface unnecessarily.
Get your SQL Server behind a firewall right now. I thought we learned that after Slammer
