Hey all,
I have a Windows 2003 Server: standard 64 bit version on a DELL PowerEdge 2850. We have SQL 2005 (No SP1 on that yet, but testing still)..lately the box has been getting hit big time, so many failed login audits in the security log that I have given up counting. Traced the IP’s, some in russia, netherlands, china, etc..but Cisco recommended I just block the individual IPs on the firewall. I don’t know about you guys but there has got to be an easier way to protect our SQL server!! I am an MCP working on her MCSE but security is still rather new to me and there are sooo many articles out there… so any “step-by-step hand holding” guides will be welcomed!!
here is an example of what is going on using sysinternal tool tcpview (keep in mind that this is only a sampling, there are over 264 more rows of the same..obviously an attack..but not sure what to do..and yes I know it’s from a German ISP..not sure if I can contact them or not…)
[System Process]:0 TCP sql001:ms-sql-s wc-133.r-195-35-218.essentkabel.com:10016
[System Process]:0 TCP sql001:ms-sql-s wc-133.r-195-35-218.essentkabel.com:10110
[System Process]:0 TCP sql001:ms-sql-s wc-133.r-195-35-218.essentkabel.com:10305
[System Process]:0 TCP sql001:ms-sql-s wc-133.r-195-35-218.essentkabel.com:10615
[System Process]:0 TCP sql001:ms-sql-s wc-133.r-195-35-218.essentkabel.com:10819
[System Process]:0 TCP sql001:ms-sql-s wc-133.r-195-35-218.essentkabel.com:10823
[System Process]:0 TCP sql001:ms-sql-s wc-133.r-195-35-218.essentkabel.com:10843
[System Process]:0 TCP sql001:ms-sql-s wc-133.r-195-35-218.essentkabel.com:10970
[System Process]:0 TCP sql001:ms-sql-s wc-133.r-195-35-218.essentkabel.com:11144
[System Process]:0 TCP sql001:ms-sql-s wc-133.r-195-35-218.essentkabel.com:11205
[System Process]:0 TCP sql001:ms-sql-s wc-133.r-195-35-218.essentkabel.com:11251
[System Process]:0 TCP sql001:ms-sql-s wc-133.r-195-35-218.essentkabel.com:11453
[System Process]:0 TCP sql001:ms-sql-s wc-133.r-195-35-218.essentkabel.com:11604
[System Process]:0 TCP sql001:ms-sql-s wc-133.r-195-35-218.essentkabel.com:11700
[System Process]:0 TCP sql001:ms-sql-s wc-133.r-195-35-218.essentkabel.com:11753
[System Process]:0 TCP sql001:ms-sql-s wc-133.r-195-35-218.essentkabel.com:11914