Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm helping a customer with an exposed SQL Server 2005. They will not budge on a firewall or VPN solution, and their logs are full of signs of a brute force attack.

Is there way to auto-ban an IP address after X failed logons to SQL Server 2005?

share|improve this question
add comment

3 Answers

No, at least not within SQL Server because SQL Server doesn't track based on IP in this manner. The IP address is exposed in the EventData for a logon trigger (added in SP2), but a logon trigger only fires with a successful logon event. A failed login wouldn't cause the trigger to fire. Running a trace where you're auditing for Failed Login security events would reveal the hostname, but this can be spoofed and it's not guaranteed to be the IP.

Could you approach this from a performance perspective? Every one of those failed hits does cause SQL Server to spin up a connection which costs CPU and memory. Because there isn't a front-end network device to filter these bad connections, the server, and SQL Server, isn't getting the performance it could get.

share|improve this answer
    
+1 for the performance angle. –  p.campbell Jul 16 '10 at 14:07
add comment

Not directly within the SQL Server world. What about changing from the default port (1433) to a different port number?

share|improve this answer
add comment

Have you suggested SmoothWall? It's free, can't get much more budget-friendly than that!

You wouldn't even NEED a beige box for it, as you can acquire a VMWare appliance.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.