I have an sql server 2005 instance running in default 1433 port. I am getting too many invalid logins from different ip address, may be some hacking programs trying to attack, i am running windows 2003 server, as the windows firewall doesn't have option to block a particular ip, but even i use an other firewall i need to monitor regularly for the new hacker IP & need to block it. Is there any other way to prevent these attacks, something like if i get number of invalid login attempts block that ip for a couple of minutes..
3 Answers
You can try running on a non-default port. That might reduce the attacks, but it's not going to eliminate them. You could also setup a VPN or SSH tunnel and only allow access through them. But you'll also have to deal with the same type of attacks against those as well.
There's no magical way to make internet hosted services only visible to the "good guys". They're either visible to everyone or they're not.
answered Nov 25, 2009 at 6:09
Do you connect to the system from a internet connection with a fixed/static ip address? if so you could whitelist allowed connections and block the rest.
For no reason should you be connecting a Windows server directly to the Internet.
For root's sake man, at least put a firewall in front of it!
Ok, now that you've done that, do you need sql server logins across the Internet? No? Okay, block that port.
-
Its a hosted sql server , it need remote access, even if i block an ip with firewall, there will be an attack from another new ip later– Priyan RNov 25, 2009 at 5:19
-
Security concepts say to use a whitelist, not a blacklist. Block everything except the one IP that needs to connect to it.– MikeyBNov 26, 2009 at 3:26
-
(of course, as others have said, using certificates or a tunnel is most secure)– MikeyBNov 26, 2009 at 3:26