2

We connect throguh RDP to our ERP solution which uses MSSQL 2008, right now I can see on windows logs and SQL logs that we have a HUGE amount of connection attempts to sa user and results in slow connections to us, users.

Since we connect through RDP and both ERP and DB are on the same server, I think I can close SQL port to the internet, and that would stop direct attacks to the DB, but our IT consultant it's not sure about it. I think it's safe to say that the only ports needed to be open through internet are RDP ports, besides that all happens in a LAN enviroment.

Am I right or am I missing something?

  • 1
    Why is your SQL Server exposed to the internet at all? Your issue here is that you can only mitigate the issue - not remove it. Even closing down ports is a bit of a weak security policy when the server is internet facing. – George.Palacios Jul 11 at 10:38
  • thanks for your answer @George.Palacios . It's a temporal server while we move to our VPN, I already have setup some scripts to stop and ban rogue connections to RDP but not to SQL server, it's not a perfect solution but it's not final either. Thing is, should it be configured to be open to the internet, or not? – orca Jul 11 at 10:46
  • 3
    "am I missing something?" If you are the administrator of this database, you are missing the inventory of applications that are allowed to connect to it. When you have one, you will know immediately if you can close the port or not. – mustaccio Jul 11 at 11:09
  • If the information you've provided is correct, then yes, you need to block the SQL Server port from the Internet. Whether you are missing something or not--impossible for us to know that unless you clarify the scope of "something." You can run sp_who to see the current connections to confirm that they are all local. – Tony Hinkle Jul 11 at 14:05
5

I wrote a blog post about the perils of having your SQL Server exposed to the internet.

You should almost never allow internet access directly to SQL Server. From your description, it sounds like you have no requirement for that, since you RDP into the machine for access. I would immediately ensure the port used by the SQL Server is blocked at the firewall.

0

Finally found the problem to those recurent connections and the issue had nothing to do with MSSQL being exposed to the inernet, because it was never opened to it in the first place. It turned out that there was another service in the VM that used the same port as our ERP license server hence launching a lot of failed connection attempts. Once this other service was stopped and changed the port, everything returned to normal.

In order to find this, netstat -abno command provided really useful, and it's the tool that gave us the solution to stop those 4 connections every second.

Thanks everyone for the help and insight.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.