2

We have detected a lot of Failure Audit errors (MSSQLSERVER) on our Web Server for.

Something like Login failed for user 'sa'. [CLIENT: 74.208.102.175]

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

IPs are unknown, and we would like to know is this a potential security issue or what can cause this.

EDITED

I adjusted Windows Firewall to prevent access to MSSQL outside server IP, but that did not work.

Here is what I did Firewall > Programs and Service > cheched MSSQL Firewall > Edit > Name:MSSQL, PortNumber 1433, TCP, scope: serverIP/255.255.255.255

1
  • Are the web and database server hosted on the same machine? What full version of sql server is running?
    – Cougar9000
    May 29, 2013 at 19:37

1 Answer 1

3

It appears that you have exposed your SQL Server to the internet, and now you are seeing brute-force attempts from the internet to log in with the well-known SQL account sa.

I don't know your business needs, but consider adjusting your firewall so that the only IP that is able to reach your database server is your web server, for instance.

Edit: If your web server and your database server are the same, the fact remains that you need to use a firewall, either software or hardware, to block incoming connections to port 1433 from the internet.

10
  • 1
    It would also be wise to either disable or rename the SA account in SQL Server.
    – Cougar9000
    May 28, 2013 at 14:38
  • @Cougar9000 good alternative, but it would also open sql for outside connections
    – John
    May 28, 2013 at 18:49
  • @Ryan Ries is there an option on SQL to close port 1433, or it can only be blocked on firewall?
    – John
    May 28, 2013 at 18:50
  • @John This needs to be done via firewall. A hardware firewall is preferred, but in the meantime you could at least use the software firewall that comes with Server 2003... it sucks, but it's better than nothing.
    – Ryan Ries
    May 28, 2013 at 18:55
  • @RyanRies I have changed the firewall setting, and will monitor Event log.
    – John
    May 28, 2013 at 19:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .