A quick summary on the events from the last 2 weeks: We noticed that our SQL Server was becoming unreliably slow. This is a critical machine that's used by one of our local supercomputing groups to run queries. They often work outside from our university to collaborate with others. We also give their collaborators direct access, and thus it is on a public ip space.

After noticing, from both the SQL and windows security logs, that there were attempts originating from asia/china area to get access, we tightened things up and are now allowing SQL port 1433 and RDP access only to our campus network and to our collaborator campuses.

However, it seems like the hacking attempts are still taking place. Anywhere from 10-20 attempts/minute are still being made to login to our SQL machine. When I view the Security log in event viewer, it's a huge wall of Audit Failures.

They all have the Event ID of 4776, and there isn't much details given. Here is what a sample event log looks like:

The computer attempted to validate the credentials for an account.

Logon Account:  marvin
Source Workstation: FATBOY
Error Code: 0xc0000064

After doing some digging, it seems that someone is attempting to login with an account that doesn't exist. The Logon Account names they use vary, and it's very clear that it's a hacker attempt. They use names such as Admin, administrator, sysadmin, accounting, office, billing, among other various things.

Now, my question is, is there a way I can prevent or tighten the security such that people from outside my network can't event ATTEMPT to login to my server? I assumed wrongly that all I would have to do was to tighten down security on the SQL port and the RDP through windows firewall. It's becoming evident to me that they can still try to access the machine without using RDP. Does anyone have any details on how this is possible, and is there a way to stop it?

I haven't been a sysadmin for very long, and my director is out on vacation. I've done my due dilligence in researching and still cannot come up with anything. Last week, the event logs were showing more useful details, such as the source ip address, that allowed me to determine where they were coming from, thus drawing the conclusion that it was a clear hacking attempt.

The current barrage of login attempts are slowing things down so much that our client's queries are timing out. Any help or insight into this would be greatly appreciated.

Thank you!

closed as off-topic by TomTom, Greg Askew, Tim Brigham, Ward, MichelZ Jul 21 '14 at 17:11

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must demonstrate a minimal understanding of the problem being solved. Try including attempted solutions, why they didn't work, and the expected results. See How can I ask better questions on Server Fault? for further guidance." – TomTom, Greg Askew, Tim Brigham, Ward, MichelZ
If this question can be reworded to fit the rules in the help center, please edit the question.

  1. Put a network firewall in front of the server. Using only the Windows firewall is like leaving the bank vault locked but the front door open. You've allowed people into the bank and it's only a matter of time before they breach the vault.

  2. In your network firewall (that you're going to put in place) allow traffic only to the ports on the server required for your partners to connect (SQL - RDP) and only from their ip address range.

  3. Run a packet capture to get more details on the hack attempts. You can run this on the server or on another workstation if you mirror the server switch port to the workstation switch port.

  4. You've allowed a group of people, who you may not have vetted, access to your server. You've also allowed their network (unvetted) access to your server. Either one could be the source of the hack attempts. Temporarily block their access to see if the attempts are originating from their networks.

  • thanks for the input. I'm going to follow through with these instructions. Thanks again! – Isaiah Lee Jul 17 '14 at 16:37
  • Glad to help... – joeqwerty Jul 17 '14 at 16:37

Yeah. That is called a firewall and something an admin should know automatically. Put a firewall in place, block all traffic that you do not want. OBVIOUSLY you do not do this.

Besides that - no.

  • TomTom, I'm sure I understand that much. My question is, HOW do I know WHAT kind of traffic this is? There is literally no details given in the logs that show where it is originating from. What kind of protocols or ports do I need to block in the firewall that will prevent them from attempting logins? – Isaiah Lee Jul 17 '14 at 16:05
  • @IsaiahLee There should be a source IP. Check the details in the event viewer, not just the description/summary. – HopelessN00b Jul 17 '14 at 16:10
  • Block everything coming from any IP that isn't one of yours or your partners. Block everything from the allowed external IPs that isn't RDP or SQL. Better yet, block everything from the outside and require a secure connection, like a tunnel, from the partner organizations. – mfinni Jul 17 '14 at 16:13
  • @HopelessN00b There really isn't many details given for some reason, here's a screenshot: s18.postimg.org/dpd3gt3x5/securitydetails.jpg – Isaiah Lee Jul 17 '14 at 16:16
  • @mfinni I guess I'm just going to have to wait until my boss gets back. Using a tunnel seems like it'd be the ideal way of doing this, but that decision is beyond what I can make. Thanks everyone for the help. – Isaiah Lee Jul 17 '14 at 16:18

Not the answer you're looking for? Browse other questions tagged or ask your own question.