Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm helping a customer with an exposed SQL Server 2005. They will not budge on a firewall or VPN solution, and their logs are full of signs of a brute force attack.

Is there way to auto-ban an IP address after X failed logons to SQL Server 2005?

share|improve this question

No, at least not within SQL Server because SQL Server doesn't track based on IP in this manner. The IP address is exposed in the EventData for a logon trigger (added in SP2), but a logon trigger only fires with a successful logon event. A failed login wouldn't cause the trigger to fire. Running a trace where you're auditing for Failed Login security events would reveal the hostname, but this can be spoofed and it's not guaranteed to be the IP.

Could you approach this from a performance perspective? Every one of those failed hits does cause SQL Server to spin up a connection which costs CPU and memory. Because there isn't a front-end network device to filter these bad connections, the server, and SQL Server, isn't getting the performance it could get.

share|improve this answer
+1 for the performance angle. – p.campbell Jul 16 '10 at 14:07

Not directly within the SQL Server world. What about changing from the default port (1433) to a different port number?

share|improve this answer

Have you suggested SmoothWall? It's free, can't get much more budget-friendly than that!

You wouldn't even NEED a beige box for it, as you can acquire a VMWare appliance.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.