-1

I run mssql server on ubuntu and sometimes the mssql service is fallen and my hosted app stops to work.

Looking at the error log and running Profiler I found these errors:

2019-10-08 13:27:47.64 Logon       Error: 18456, Severity: 14, State: 5.
2019-10-08 13:27:47.64 Logon       Login failed for user 'mssqla'. Reason: Could not find a login matching the name provided. [CLIENT: 123.125.125.248]

2019-10-08 13:27:46.32 Logon       Error: 18456, Severity: 14, State: 8.
2019-10-08 13:27:46.32 Logon       Login failed for user 'sa'. Reason: Password did not match that for the login provided. [CLIENT: 123.125.125.248]

2019-10-08 13:28:57.13 Logon       Error: 18456, Severity: 14, State: 5.
2019-10-08 13:28:57.13 Logon       Login failed for user 'usera'. Reason: Could not find a login matching the name provided. [CLIENT: 123.125.125.248]

The users usera and mssqla don't exist and never were and I checked the ip address location and it shows it's origin is from China.

Profiler trace results: enter image description here

I search the process id in my ubuntu using the command sudo ps -A and processes not exist.

Am I being paranoid or someone from China tries to hack my Database and how can I stop him?

  • 1
    When you expose SQL Server to the public internet, you will have script kiddies trying to hack in continuously. Is there a reason you want anyone in the world accessing your server over the internet? If not, consider appropriate firewall rules, VPN, etc. – Dan Guzman Oct 8 '19 at 10:59
  • @DanGuzman My website and my ms-sql server are on the same server, I don't understand how my website can work without accessing sql-server. – Offir Pe'er Oct 8 '19 at 11:02
  • 2
    Since they are on the same server, SQL Server doesn't need to listen on an external interface so you can use 127.0.0.1. Create a firewall rule to block external port 1433 traffic except from hosts you use for remote management. – Dan Guzman Oct 8 '19 at 11:11
  • @DanGuzman thx I will try that, do you have any idea how those hackers found out about my website? – Offir Pe'er Oct 8 '19 at 11:14
  • Mostly likely just a scan of random IP addresses. – Dan Guzman Oct 8 '19 at 11:28
0

You could be able to do auditing the activities and trace the activities within SQL Instance, for blocking part the better place is firewall, you may follow this approach to automate the firewall blocking entries at windows firewall level.

In addition to the blocking, some security recommendations that you can refer to:

| improve this answer | |
0

That your webserver needs access to the database server is out of question - but at the same time this should be only in your local subnet. If possible place the database on a second server - even a properly run virtual one inside vmware ws or similar will do - just limit the access to the database server to your local subnet.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.