A quick summary on the events from the last 2 weeks: We noticed that our SQL Server was becoming unreliably slow. This is a critical machine that's used by one of our local supercomputing groups to run queries. They often work outside from our university to collaborate with others. We also give their collaborators direct access, and thus it is on a public ip space.
After noticing, from both the SQL and windows security logs, that there were attempts originating from asia/china area to get access, we tightened things up and are now allowing SQL port 1433 and RDP access only to our campus network and to our collaborator campuses.
However, it seems like the hacking attempts are still taking place. Anywhere from 10-20 attempts/minute are still being made to login to our SQL machine. When I view the Security log in event viewer, it's a huge wall of Audit Failures.
They all have the Event ID of 4776, and there isn't much details given. Here is what a sample event log looks like:
The computer attempted to validate the credentials for an account. Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon Account: marvin Source Workstation: FATBOY Error Code: 0xc0000064
After doing some digging, it seems that someone is attempting to login with an account that doesn't exist. The Logon Account names they use vary, and it's very clear that it's a hacker attempt. They use names such as Admin, administrator, sysadmin, accounting, office, billing, among other various things.
Now, my question is, is there a way I can prevent or tighten the security such that people from outside my network can't event ATTEMPT to login to my server? I assumed wrongly that all I would have to do was to tighten down security on the SQL port and the RDP through windows firewall. It's becoming evident to me that they can still try to access the machine without using RDP. Does anyone have any details on how this is possible, and is there a way to stop it?
I haven't been a sysadmin for very long, and my director is out on vacation. I've done my due dilligence in researching and still cannot come up with anything. Last week, the event logs were showing more useful details, such as the source ip address, that allowed me to determine where they were coming from, thus drawing the conclusion that it was a clear hacking attempt.
The current barrage of login attempts are slowing things down so much that our client's queries are timing out. Any help or insight into this would be greatly appreciated.