I'm having problems with simultanous brute force attempts on my Windows Server 2008 R2 and the MS-SQL Server which is on it.
- I have renamed the Windows Administrator account (Administrator)
- I have renamed and disabled the SQL Server account (sa)
- I have installed Windows Security Essentials to serve as AntiVirus
I have been adviced to lock down the firewall for ALL inbound and outbound connection EXCEPT for the ones that are truely necessary. But i dont know precisely how to do it and which ports that are truely necessary.
I have also been adviced to totally lock down for connecting to the SQL server via SQL authentication and only do it with Windows authentication. But can my ASP Classic application still use the SQL server then?
The server are being used to webhosting, SQL database hosting and mailserver (POP3, SMTP & IMAP). The server has also Parallels PLESK installed, including HORDE Webmail.
I have taken a screenshot of the server's firewall settings ( http://www.oltm.dk/x/settings.jpg ) and exported the firewall inbound-rules ( http://www.oltm.dk/x/inbound.txt ) and outbound-rules ( ww.oltm.dk/x/outbound.txt )
I am brand new to Windows Server 2008 R2, so forgive me, if I am missing something completely obvious :)