0

I had many attacks on the port 1433 of my DB . I renamed the SA account and changed the DB port (my problem was solved thanks to dba.stackexchange.com ) . But i went to the windows server logs again i found some attacks (unsuccessful login ) .

My questions are :

on which port the user was trying to access the machine (3389 ?) .

Can i get more info on what the user was trying to do ?

How to stop these attacks ?

Any comment would help

enter image description here

Improve this question
11
  • 2
    database should not be available on internet, or only from some IP, why your MSSQL is visible from internet ? 3389 is your Terminal server port. thoose request are common Bruteforce attack...Logs are saying bad username or password is that not enought ? :P
    – Froggiz
    Nov 6, 2015 at 9:16
  • My DB is on a port (very secret) as i need to access it from outside to use some reporting that query the database directly . I will remadiate this later . So the user was trying to do 3389 access ?
    – Momo
    Nov 6, 2015 at 9:18
  • more infos in details tab, i presume it is 3389 as it is default brute force attack on windows
    – Froggiz
    Nov 6, 2015 at 9:19
  • btw when attacks occur, i temp block the ip for the day, get ip provider, and report ip to the abuse mail of the company
    – Froggiz
    Nov 6, 2015 at 9:27
  • How can i find the IP of this chineese pirate ?
    – Momo
    Nov 6, 2015 at 9:31

1 Answer 1

Reset to default
2

These will be automated scans ...

  • Configure your firewall with a default DROP policy on incoming connections.

  • Only allow incoming connections on ports that are in use.

  • Restrict access to ports that are not public to specified IP addresses.

  • Don't have your database exposed to the wider internet.

Improve this answer
5
  • I do not understand the first point . I am allowing only ports in use , i cant restrict address to specific ip as i am mobile . I need to access the DB from anywhere in the world . I am thinking about VPN that would help i imagine to acheive the last 3 points ?
    – Momo
    Nov 6, 2015 at 9:30
  • If you can guarantee that the VPN server will always have 1 public IP on the other end of your tunnel. Otherwise, do you have a firewall at all or does your ISP provide you with a managed firewall service?
    – Recct
    Nov 6, 2015 at 9:35
  • @JavaMain 3389 is RDP port, are you allowing RDP too? Yes the best thing to do would be firewall off the server and setup a VPN. 3389 isn't encrypted so it isn't secure. I assumed you have enable encryption on your SQL server too?
    – lbanz
    Nov 6, 2015 at 9:38
  • Actually i am on amazon webservice using the EC2 machines whatever is there i am using it . Yes the IP should be fixed ip .
    – Momo
    Nov 6, 2015 at 9:44
  • I am on SQL standard so no TDE available . encrypting and decrypting is expensive in performace i guess .
    – Momo
    Nov 6, 2015 at 9:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .