sql2005 standard edition
In replication monitor, under Publication tab, the Current Average
Performance and Current Worst Performance show "Poor" for one publication,
and this has been like this for a few days.
The publisher server is not under heavy load at all. In Perfmon I checked
Delivery Latency and Delivered Trans.sec for the related replication jobs and
all show 0.
Could anybody tell me what else I need to look into and where to start with
troubleshooting? I am new to replication. Thanks a lot.
Claudia
Look on the subscriber to see if there are user triggers on this or
different indexes. Also is the subscriber the same hardware and
configuration as the other subscribers? Are there any other processes
running on this machine?
Hilary Cotter
Looking for a SQL Server replication book?
http://www.nwsu.com/0974973602.html
Looking for a FAQ on Indexing Services/SQL FTS
http://www.indexserverfaq.com
"Claudia" <Claudia@.discussions.microsoft.com> wrote in message
news:1292940D-2268-4C27-ADED-5206FC3CF225@.microsoft.com...
> sql2005 standard edition
> In replication monitor, under Publication tab, the Current Average
> Performance and Current Worst Performance show "Poor" for one publication,
> and this has been like this for a few days.
> The publisher server is not under heavy load at all. In Perfmon I checked
> Delivery Latency and Delivered Trans.sec for the related replication jobs
> and
> all show 0.
> Could anybody tell me what else I need to look into and where to start
> with
> troubleshooting? I am new to replication. Thanks a lot.
> Claudia
>
|||The subscriber hardware is the same. No triggers on subscriber. The tables
involved in replication are all small tables (18 tables, the biggest one has
600 records, and the rest of tables have < 100 records). There're a few
connections to the subscriber DB but they are in sleeping mode. The only
connections with Open Transaction showing 1 are from the replication, which
seems normal.
The articles
"Hilary Cotter" wrote:
> Look on the subscriber to see if there are user triggers on this or
> different indexes. Also is the subscriber the same hardware and
> configuration as the other subscribers? Are there any other processes
> running on this machine?
> --
> Hilary Cotter
> Looking for a SQL Server replication book?
> http://www.nwsu.com/0974973602.html
> Looking for a FAQ on Indexing Services/SQL FTS
> http://www.indexserverfaq.com
>
> "Claudia" <Claudia@.discussions.microsoft.com> wrote in message
> news:1292940D-2268-4C27-ADED-5206FC3CF225@.microsoft.com...
>
>
|||Have you updated the indexes?
Hilary Cotter
Looking for a SQL Server replication book?
http://www.nwsu.com/0974973602.html
Looking for a FAQ on Indexing Services/SQL FTS
http://www.indexserverfaq.com
"Claudia" <Claudia@.discussions.microsoft.com> wrote in message
news:7D92F872-3FFE-4AF6-B367-D58CD60C85E2@.microsoft.com...[vbcol=seagreen]
> The subscriber hardware is the same. No triggers on subscriber. The tables
> involved in replication are all small tables (18 tables, the biggest one
> has
> 600 records, and the rest of tables have < 100 records). There're a few
> connections to the subscriber DB but they are in sleeping mode. The only
> connections with Open Transaction showing 1 are from the replication,
> which
> seems normal.
>
> The articles
> "Hilary Cotter" wrote:
Showing posts with label monitor. Show all posts
Showing posts with label monitor. Show all posts
Wednesday, March 28, 2012
Saturday, February 25, 2012
Please Help: Someone is hacking my server!
Hi,
My SQL server is has a public IP address admins and developers can access
and manage remotely (this is the requirement)
When I monitor the SQL server port I can see some one is brutally trying to
hack my server. There are almost 70 connections from IP address
66.15.173.105 that try to connect to my server.
My guess is he is trying to use brute force technique to find the sa
password.
What is the best way to prevent that? Can I adjust some settings, to have
failed logins wait for 10 seconds?
Any help would be appreciated,
Alan
Hi
You can't do much as you exposed your SQL Server to the outside world.
At best, you can filter the source IP and port at the router, blocking
66.15.173.105
SQL Server 2000 does not allow account lockouts or account policies.
If developers and admins need access to your SQL Server, look at
implementing a VPN, but for sure, don't expose SQL Server directly to the
internet.
Regards
Mike Epprecht, Microsoft SQL Server MVP
Zurich, Switzerland
IM: mike@.epprecht.net
MVP Program: http://www.microsoft.com/mvp
Blog: http://www.msmvps.com/epprecht/
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> Hi,
>
> My SQL server is has a public IP address admins and developers can access
> and manage remotely (this is the requirement)
>
> When I monitor the SQL server port I can see some one is brutally trying
> to hack my server. There are almost 70 connections from IP address
> 66.15.173.105 that try to connect to my server.
>
> My guess is he is trying to use brute force technique to find the sa
> password.
>
> What is the best way to prevent that? Can I adjust some settings, to have
> failed logins wait for 10 seconds?
>
> Any help would be appreciated,
> Alan
>
>
>
|||Change the port from 1433, block that IP address, make the sa password
something ridiculously difficult (or better yet, switch to Windows
integrated security only) and implement VPN.
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> Hi,
>
> My SQL server is has a public IP address admins and developers can access
> and manage remotely (this is the requirement)
>
> When I monitor the SQL server port I can see some one is brutally trying
> to hack my server. There are almost 70 connections from IP address
> 66.15.173.105 that try to connect to my server.
>
> My guess is he is trying to use brute force technique to find the sa
> password.
>
> What is the best way to prevent that? Can I adjust some settings, to have
> failed logins wait for 10 seconds?
>
> Any help would be appreciated,
> Alan
>
>
>
|||You can also use IPSEC & or your firewall and only allow specific IP & PORT
access to your SQL Box.
|||Blocking the attacking IP probably won't help -- it's probably a dynamic IP.
This might be painful, but...create a new admin. login with a hard-to-guess
name, use a strong password, and DELETE sa.
-- Jeff
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> Hi,
>
> My SQL server is has a public IP address admins and developers can access
> and manage remotely (this is the requirement)
>
> When I monitor the SQL server port I can see some one is brutally trying
> to hack my server. There are almost 70 connections from IP address
> 66.15.173.105 that try to connect to my server.
>
> My guess is he is trying to use brute force technique to find the sa
> password.
>
> What is the best way to prevent that? Can I adjust some settings, to have
> failed logins wait for 10 seconds?
>
> Any help would be appreciated,
> Alan
>
>
>
|||can not delete sa.
"Beige Bond" <BeigeBond@.hotmail.com> wrote in message
news:OvFRYk0TFHA.2556@.TK2MSFTNGP12.phx.gbl...
> Blocking the attacking IP probably won't help -- it's probably a dynamic
IP.
> This might be painful, but...create a new admin. login with a
hard-to-guess[vbcol=seagreen]
> name, use a strong password, and DELETE sa.
> -- Jeff
> "A.M" <Hate-Spam@.nowhere.com> wrote in message
> news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
access[vbcol=seagreen]
have
>
|||Apologies for my ignorance. Looks like turning off Mixed Mode Authentication
is the only way to disable sa. Some interesting notes at:
http://msdn.microsoft.com/library/de...erver_5un8.asp
"Dennis Redfield" <dennis_redfield@.newsgroup.nospam> wrote in message
news:eGetLtBUFHA.3644@.TK2MSFTNGP10.phx.gbl...
> can not delete sa.
> "Beige Bond" <BeigeBond@.hotmail.com> wrote in message
> news:OvFRYk0TFHA.2556@.TK2MSFTNGP12.phx.gbl...
> IP.
> hard-to-guess
> access
> have
>
|||In addition to all of these suggestions, you can also use the firewall
to block access from all outside IPs except those used by the admins
and developers.
Still the solution is to get a VPN setup and get the SQL Server box
off the internet. To expensive you say? How much will it cost your
company *when* the hacker gets through? I bet it's more than the cost
of some VPNs.
Joe Webb
SQL Server MVP
~~~
Get up to speed quickly with SQLNS
http://www.amazon.com/exec/obidos/tg...l/-/0972688811
I support PASS, the Professional Association for SQL Server.
(www.sqlpass.org)
On Sat, 30 Apr 2005 11:39:51 -0400, "Michael C#" <xyz@.abcdef.com>
wrote:
>Change the port from 1433, block that IP address, make the sa password
>something ridiculously difficult (or better yet, switch to Windows
>integrated security only) and implement VPN.
>"A.M" <Hate-Spam@.nowhere.com> wrote in message
>news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
>
|||Thank you everyone for your help and suggestions. I convinced development
team to use terminal services instead.
However, lack of proper password policy for SQL server is quite scary! It is
easy build a try/error program to hack sa password based on available
password dictionary databases!
Thanks again,
Alan
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> Hi,
>
> My SQL server is has a public IP address admins and developers can access
> and manage remotely (this is the requirement)
>
> When I monitor the SQL server port I can see some one is brutally trying
> to hack my server. There are almost 70 connections from IP address
> 66.15.173.105 that try to connect to my server.
>
> My guess is he is trying to use brute force technique to find the sa
> password.
>
> What is the best way to prevent that? Can I adjust some settings, to have
> failed logins wait for 10 seconds?
>
> Any help would be appreciated,
> Alan
>
>
>
|||That's probably why Windows Integrated is the recommended security model.
Why duplicate all of Windows' password policy functionality in SQL Server
when it's already accessible via Integrated Security?
Are you exposing Terminal Services to the Internet as well, or are you
making them use VPN? Don't forget the Administrator account on your domain
and local machines, which can usually use Terminal Services to log in as
well.
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:%23YGjqxOUFHA.2892@.TK2MSFTNGP14.phx.gbl...
>
> Thank you everyone for your help and suggestions. I convinced development
> team to use terminal services instead.
>
> However, lack of proper password policy for SQL server is quite scary! It
> is easy build a try/error program to hack sa password based on available
> password dictionary databases!
>
> Thanks again,
> Alan
>
> "A.M" <Hate-Spam@.nowhere.com> wrote in message
> news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
>
My SQL server is has a public IP address admins and developers can access
and manage remotely (this is the requirement)
When I monitor the SQL server port I can see some one is brutally trying to
hack my server. There are almost 70 connections from IP address
66.15.173.105 that try to connect to my server.
My guess is he is trying to use brute force technique to find the sa
password.
What is the best way to prevent that? Can I adjust some settings, to have
failed logins wait for 10 seconds?
Any help would be appreciated,
Alan
Hi
You can't do much as you exposed your SQL Server to the outside world.
At best, you can filter the source IP and port at the router, blocking
66.15.173.105
SQL Server 2000 does not allow account lockouts or account policies.
If developers and admins need access to your SQL Server, look at
implementing a VPN, but for sure, don't expose SQL Server directly to the
internet.
Regards
Mike Epprecht, Microsoft SQL Server MVP
Zurich, Switzerland
IM: mike@.epprecht.net
MVP Program: http://www.microsoft.com/mvp
Blog: http://www.msmvps.com/epprecht/
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> Hi,
>
> My SQL server is has a public IP address admins and developers can access
> and manage remotely (this is the requirement)
>
> When I monitor the SQL server port I can see some one is brutally trying
> to hack my server. There are almost 70 connections from IP address
> 66.15.173.105 that try to connect to my server.
>
> My guess is he is trying to use brute force technique to find the sa
> password.
>
> What is the best way to prevent that? Can I adjust some settings, to have
> failed logins wait for 10 seconds?
>
> Any help would be appreciated,
> Alan
>
>
>
|||Change the port from 1433, block that IP address, make the sa password
something ridiculously difficult (or better yet, switch to Windows
integrated security only) and implement VPN.
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> Hi,
>
> My SQL server is has a public IP address admins and developers can access
> and manage remotely (this is the requirement)
>
> When I monitor the SQL server port I can see some one is brutally trying
> to hack my server. There are almost 70 connections from IP address
> 66.15.173.105 that try to connect to my server.
>
> My guess is he is trying to use brute force technique to find the sa
> password.
>
> What is the best way to prevent that? Can I adjust some settings, to have
> failed logins wait for 10 seconds?
>
> Any help would be appreciated,
> Alan
>
>
>
|||You can also use IPSEC & or your firewall and only allow specific IP & PORT
access to your SQL Box.
|||Blocking the attacking IP probably won't help -- it's probably a dynamic IP.
This might be painful, but...create a new admin. login with a hard-to-guess
name, use a strong password, and DELETE sa.
-- Jeff
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> Hi,
>
> My SQL server is has a public IP address admins and developers can access
> and manage remotely (this is the requirement)
>
> When I monitor the SQL server port I can see some one is brutally trying
> to hack my server. There are almost 70 connections from IP address
> 66.15.173.105 that try to connect to my server.
>
> My guess is he is trying to use brute force technique to find the sa
> password.
>
> What is the best way to prevent that? Can I adjust some settings, to have
> failed logins wait for 10 seconds?
>
> Any help would be appreciated,
> Alan
>
>
>
|||can not delete sa.
"Beige Bond" <BeigeBond@.hotmail.com> wrote in message
news:OvFRYk0TFHA.2556@.TK2MSFTNGP12.phx.gbl...
> Blocking the attacking IP probably won't help -- it's probably a dynamic
IP.
> This might be painful, but...create a new admin. login with a
hard-to-guess[vbcol=seagreen]
> name, use a strong password, and DELETE sa.
> -- Jeff
> "A.M" <Hate-Spam@.nowhere.com> wrote in message
> news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
access[vbcol=seagreen]
have
>
|||Apologies for my ignorance. Looks like turning off Mixed Mode Authentication
is the only way to disable sa. Some interesting notes at:
http://msdn.microsoft.com/library/de...erver_5un8.asp
"Dennis Redfield" <dennis_redfield@.newsgroup.nospam> wrote in message
news:eGetLtBUFHA.3644@.TK2MSFTNGP10.phx.gbl...
> can not delete sa.
> "Beige Bond" <BeigeBond@.hotmail.com> wrote in message
> news:OvFRYk0TFHA.2556@.TK2MSFTNGP12.phx.gbl...
> IP.
> hard-to-guess
> access
> have
>
|||In addition to all of these suggestions, you can also use the firewall
to block access from all outside IPs except those used by the admins
and developers.
Still the solution is to get a VPN setup and get the SQL Server box
off the internet. To expensive you say? How much will it cost your
company *when* the hacker gets through? I bet it's more than the cost
of some VPNs.
Joe Webb
SQL Server MVP
~~~
Get up to speed quickly with SQLNS
http://www.amazon.com/exec/obidos/tg...l/-/0972688811
I support PASS, the Professional Association for SQL Server.
(www.sqlpass.org)
On Sat, 30 Apr 2005 11:39:51 -0400, "Michael C#" <xyz@.abcdef.com>
wrote:
>Change the port from 1433, block that IP address, make the sa password
>something ridiculously difficult (or better yet, switch to Windows
>integrated security only) and implement VPN.
>"A.M" <Hate-Spam@.nowhere.com> wrote in message
>news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
>
|||Thank you everyone for your help and suggestions. I convinced development
team to use terminal services instead.
However, lack of proper password policy for SQL server is quite scary! It is
easy build a try/error program to hack sa password based on available
password dictionary databases!
Thanks again,
Alan
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> Hi,
>
> My SQL server is has a public IP address admins and developers can access
> and manage remotely (this is the requirement)
>
> When I monitor the SQL server port I can see some one is brutally trying
> to hack my server. There are almost 70 connections from IP address
> 66.15.173.105 that try to connect to my server.
>
> My guess is he is trying to use brute force technique to find the sa
> password.
>
> What is the best way to prevent that? Can I adjust some settings, to have
> failed logins wait for 10 seconds?
>
> Any help would be appreciated,
> Alan
>
>
>
|||That's probably why Windows Integrated is the recommended security model.
Why duplicate all of Windows' password policy functionality in SQL Server
when it's already accessible via Integrated Security?
Are you exposing Terminal Services to the Internet as well, or are you
making them use VPN? Don't forget the Administrator account on your domain
and local machines, which can usually use Terminal Services to log in as
well.
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:%23YGjqxOUFHA.2892@.TK2MSFTNGP14.phx.gbl...
>
> Thank you everyone for your help and suggestions. I convinced development
> team to use terminal services instead.
>
> However, lack of proper password policy for SQL server is quite scary! It
> is easy build a try/error program to hack sa password based on available
> password dictionary databases!
>
> Thanks again,
> Alan
>
> "A.M" <Hate-Spam@.nowhere.com> wrote in message
> news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
>
Please Help: Someone is hacking my server!
Hi,
My SQL server is has a public IP address admins and developers can access
and manage remotely (this is the requirement)
When I monitor the SQL server port I can see some one is brutally trying to
hack my server. There are almost 70 connections from IP address
66.15.173.105 that try to connect to my server.
My guess is he is trying to use brute force technique to find the sa
password.
What is the best way to prevent that? Can I adjust some settings, to have
failed logins wait for 10 seconds?
Any help would be appreciated,
Alan
Hi
You can't do much as you exposed your SQL Server to the outside world.
At best, you can filter the source IP and port at the router, blocking
66.15.173.105
SQL Server 2000 does not allow account lockouts or account policies.
If developers and admins need access to your SQL Server, look at
implementing a VPN, but for sure, don't expose SQL Server directly to the
internet.
Regards
Mike Epprecht, Microsoft SQL Server MVP
Zurich, Switzerland
IM: mike@.epprecht.net
MVP Program: http://www.microsoft.com/mvp
Blog: http://www.msmvps.com/epprecht/
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> Hi,
>
> My SQL server is has a public IP address admins and developers can access
> and manage remotely (this is the requirement)
>
> When I monitor the SQL server port I can see some one is brutally trying
> to hack my server. There are almost 70 connections from IP address
> 66.15.173.105 that try to connect to my server.
>
> My guess is he is trying to use brute force technique to find the sa
> password.
>
> What is the best way to prevent that? Can I adjust some settings, to have
> failed logins wait for 10 seconds?
>
> Any help would be appreciated,
> Alan
>
>
>
|||Change the port from 1433, block that IP address, make the sa password
something ridiculously difficult (or better yet, switch to Windows
integrated security only) and implement VPN.
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> Hi,
>
> My SQL server is has a public IP address admins and developers can access
> and manage remotely (this is the requirement)
>
> When I monitor the SQL server port I can see some one is brutally trying
> to hack my server. There are almost 70 connections from IP address
> 66.15.173.105 that try to connect to my server.
>
> My guess is he is trying to use brute force technique to find the sa
> password.
>
> What is the best way to prevent that? Can I adjust some settings, to have
> failed logins wait for 10 seconds?
>
> Any help would be appreciated,
> Alan
>
>
>
|||You can also use IPSEC & or your firewall and only allow specific IP & PORT
access to your SQL Box.
|||Blocking the attacking IP probably won't help -- it's probably a dynamic IP.
This might be painful, but...create a new admin. login with a hard-to-guess
name, use a strong password, and DELETE sa.
-- Jeff
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> Hi,
>
> My SQL server is has a public IP address admins and developers can access
> and manage remotely (this is the requirement)
>
> When I monitor the SQL server port I can see some one is brutally trying
> to hack my server. There are almost 70 connections from IP address
> 66.15.173.105 that try to connect to my server.
>
> My guess is he is trying to use brute force technique to find the sa
> password.
>
> What is the best way to prevent that? Can I adjust some settings, to have
> failed logins wait for 10 seconds?
>
> Any help would be appreciated,
> Alan
>
>
>
|||can not delete sa.
"Beige Bond" <BeigeBond@.hotmail.com> wrote in message
news:OvFRYk0TFHA.2556@.TK2MSFTNGP12.phx.gbl...
> Blocking the attacking IP probably won't help -- it's probably a dynamic
IP.
> This might be painful, but...create a new admin. login with a
hard-to-guess[vbcol=seagreen]
> name, use a strong password, and DELETE sa.
> -- Jeff
> "A.M" <Hate-Spam@.nowhere.com> wrote in message
> news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
access[vbcol=seagreen]
have
>
|||Apologies for my ignorance. Looks like turning off Mixed Mode Authentication
is the only way to disable sa. Some interesting notes at:
http://msdn.microsoft.com/library/de...erver_5un8.asp
"Dennis Redfield" <dennis_redfield@.newsgroup.nospam> wrote in message
news:eGetLtBUFHA.3644@.TK2MSFTNGP10.phx.gbl...
> can not delete sa.
> "Beige Bond" <BeigeBond@.hotmail.com> wrote in message
> news:OvFRYk0TFHA.2556@.TK2MSFTNGP12.phx.gbl...
> IP.
> hard-to-guess
> access
> have
>
|||In addition to all of these suggestions, you can also use the firewall
to block access from all outside IPs except those used by the admins
and developers.
Still the solution is to get a VPN setup and get the SQL Server box
off the internet. To expensive you say? How much will it cost your
company *when* the hacker gets through? I bet it's more than the cost
of some VPNs.
Joe Webb
SQL Server MVP
~~~
Get up to speed quickly with SQLNS
http://www.amazon.com/exec/obidos/tg...l/-/0972688811
I support PASS, the Professional Association for SQL Server.
(www.sqlpass.org)
On Sat, 30 Apr 2005 11:39:51 -0400, "Michael C#" <xyz@.abcdef.com>
wrote:
>Change the port from 1433, block that IP address, make the sa password
>something ridiculously difficult (or better yet, switch to Windows
>integrated security only) and implement VPN.
>"A.M" <Hate-Spam@.nowhere.com> wrote in message
>news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
>
|||Thank you everyone for your help and suggestions. I convinced development
team to use terminal services instead.
However, lack of proper password policy for SQL server is quite scary! It is
easy build a try/error program to hack sa password based on available
password dictionary databases!
Thanks again,
Alan
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> Hi,
>
> My SQL server is has a public IP address admins and developers can access
> and manage remotely (this is the requirement)
>
> When I monitor the SQL server port I can see some one is brutally trying
> to hack my server. There are almost 70 connections from IP address
> 66.15.173.105 that try to connect to my server.
>
> My guess is he is trying to use brute force technique to find the sa
> password.
>
> What is the best way to prevent that? Can I adjust some settings, to have
> failed logins wait for 10 seconds?
>
> Any help would be appreciated,
> Alan
>
>
>
|||That's probably why Windows Integrated is the recommended security model.
Why duplicate all of Windows' password policy functionality in SQL Server
when it's already accessible via Integrated Security?
Are you exposing Terminal Services to the Internet as well, or are you
making them use VPN? Don't forget the Administrator account on your domain
and local machines, which can usually use Terminal Services to log in as
well.
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:%23YGjqxOUFHA.2892@.TK2MSFTNGP14.phx.gbl...
>
> Thank you everyone for your help and suggestions. I convinced development
> team to use terminal services instead.
>
> However, lack of proper password policy for SQL server is quite scary! It
> is easy build a try/error program to hack sa password based on available
> password dictionary databases!
>
> Thanks again,
> Alan
>
> "A.M" <Hate-Spam@.nowhere.com> wrote in message
> news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
>
My SQL server is has a public IP address admins and developers can access
and manage remotely (this is the requirement)
When I monitor the SQL server port I can see some one is brutally trying to
hack my server. There are almost 70 connections from IP address
66.15.173.105 that try to connect to my server.
My guess is he is trying to use brute force technique to find the sa
password.
What is the best way to prevent that? Can I adjust some settings, to have
failed logins wait for 10 seconds?
Any help would be appreciated,
Alan
Hi
You can't do much as you exposed your SQL Server to the outside world.
At best, you can filter the source IP and port at the router, blocking
66.15.173.105
SQL Server 2000 does not allow account lockouts or account policies.
If developers and admins need access to your SQL Server, look at
implementing a VPN, but for sure, don't expose SQL Server directly to the
internet.
Regards
Mike Epprecht, Microsoft SQL Server MVP
Zurich, Switzerland
IM: mike@.epprecht.net
MVP Program: http://www.microsoft.com/mvp
Blog: http://www.msmvps.com/epprecht/
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> Hi,
>
> My SQL server is has a public IP address admins and developers can access
> and manage remotely (this is the requirement)
>
> When I monitor the SQL server port I can see some one is brutally trying
> to hack my server. There are almost 70 connections from IP address
> 66.15.173.105 that try to connect to my server.
>
> My guess is he is trying to use brute force technique to find the sa
> password.
>
> What is the best way to prevent that? Can I adjust some settings, to have
> failed logins wait for 10 seconds?
>
> Any help would be appreciated,
> Alan
>
>
>
|||Change the port from 1433, block that IP address, make the sa password
something ridiculously difficult (or better yet, switch to Windows
integrated security only) and implement VPN.
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> Hi,
>
> My SQL server is has a public IP address admins and developers can access
> and manage remotely (this is the requirement)
>
> When I monitor the SQL server port I can see some one is brutally trying
> to hack my server. There are almost 70 connections from IP address
> 66.15.173.105 that try to connect to my server.
>
> My guess is he is trying to use brute force technique to find the sa
> password.
>
> What is the best way to prevent that? Can I adjust some settings, to have
> failed logins wait for 10 seconds?
>
> Any help would be appreciated,
> Alan
>
>
>
|||You can also use IPSEC & or your firewall and only allow specific IP & PORT
access to your SQL Box.
|||Blocking the attacking IP probably won't help -- it's probably a dynamic IP.
This might be painful, but...create a new admin. login with a hard-to-guess
name, use a strong password, and DELETE sa.
-- Jeff
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> Hi,
>
> My SQL server is has a public IP address admins and developers can access
> and manage remotely (this is the requirement)
>
> When I monitor the SQL server port I can see some one is brutally trying
> to hack my server. There are almost 70 connections from IP address
> 66.15.173.105 that try to connect to my server.
>
> My guess is he is trying to use brute force technique to find the sa
> password.
>
> What is the best way to prevent that? Can I adjust some settings, to have
> failed logins wait for 10 seconds?
>
> Any help would be appreciated,
> Alan
>
>
>
|||can not delete sa.
"Beige Bond" <BeigeBond@.hotmail.com> wrote in message
news:OvFRYk0TFHA.2556@.TK2MSFTNGP12.phx.gbl...
> Blocking the attacking IP probably won't help -- it's probably a dynamic
IP.
> This might be painful, but...create a new admin. login with a
hard-to-guess[vbcol=seagreen]
> name, use a strong password, and DELETE sa.
> -- Jeff
> "A.M" <Hate-Spam@.nowhere.com> wrote in message
> news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
access[vbcol=seagreen]
have
>
|||Apologies for my ignorance. Looks like turning off Mixed Mode Authentication
is the only way to disable sa. Some interesting notes at:
http://msdn.microsoft.com/library/de...erver_5un8.asp
"Dennis Redfield" <dennis_redfield@.newsgroup.nospam> wrote in message
news:eGetLtBUFHA.3644@.TK2MSFTNGP10.phx.gbl...
> can not delete sa.
> "Beige Bond" <BeigeBond@.hotmail.com> wrote in message
> news:OvFRYk0TFHA.2556@.TK2MSFTNGP12.phx.gbl...
> IP.
> hard-to-guess
> access
> have
>
|||In addition to all of these suggestions, you can also use the firewall
to block access from all outside IPs except those used by the admins
and developers.
Still the solution is to get a VPN setup and get the SQL Server box
off the internet. To expensive you say? How much will it cost your
company *when* the hacker gets through? I bet it's more than the cost
of some VPNs.
Joe Webb
SQL Server MVP
~~~
Get up to speed quickly with SQLNS
http://www.amazon.com/exec/obidos/tg...l/-/0972688811
I support PASS, the Professional Association for SQL Server.
(www.sqlpass.org)
On Sat, 30 Apr 2005 11:39:51 -0400, "Michael C#" <xyz@.abcdef.com>
wrote:
>Change the port from 1433, block that IP address, make the sa password
>something ridiculously difficult (or better yet, switch to Windows
>integrated security only) and implement VPN.
>"A.M" <Hate-Spam@.nowhere.com> wrote in message
>news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
>
|||Thank you everyone for your help and suggestions. I convinced development
team to use terminal services instead.
However, lack of proper password policy for SQL server is quite scary! It is
easy build a try/error program to hack sa password based on available
password dictionary databases!
Thanks again,
Alan
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> Hi,
>
> My SQL server is has a public IP address admins and developers can access
> and manage remotely (this is the requirement)
>
> When I monitor the SQL server port I can see some one is brutally trying
> to hack my server. There are almost 70 connections from IP address
> 66.15.173.105 that try to connect to my server.
>
> My guess is he is trying to use brute force technique to find the sa
> password.
>
> What is the best way to prevent that? Can I adjust some settings, to have
> failed logins wait for 10 seconds?
>
> Any help would be appreciated,
> Alan
>
>
>
|||That's probably why Windows Integrated is the recommended security model.
Why duplicate all of Windows' password policy functionality in SQL Server
when it's already accessible via Integrated Security?
Are you exposing Terminal Services to the Internet as well, or are you
making them use VPN? Don't forget the Administrator account on your domain
and local machines, which can usually use Terminal Services to log in as
well.
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:%23YGjqxOUFHA.2892@.TK2MSFTNGP14.phx.gbl...
>
> Thank you everyone for your help and suggestions. I convinced development
> team to use terminal services instead.
>
> However, lack of proper password policy for SQL server is quite scary! It
> is easy build a try/error program to hack sa password based on available
> password dictionary databases!
>
> Thanks again,
> Alan
>
> "A.M" <Hate-Spam@.nowhere.com> wrote in message
> news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
>
Please Help: Someone is hacking my server!
Hi,
My SQL server is has a public IP address admins and developers can access
and manage remotely (this is the requirement)
When I monitor the SQL server port I can see some one is brutally trying to
hack my server. There are almost 70 connections from IP address
66.15.173.105 that try to connect to my server.
My guess is he is trying to use brute force technique to find the sa
password.
What is the best way to prevent that? Can I adjust some settings, to have
failed logins wait for 10 seconds?
Any help would be appreciated,
AlanHi
You can't do much as you exposed your SQL Server to the outside world.
At best, you can filter the source IP and port at the router, blocking
66.15.173.105
SQL Server 2000 does not allow account lockouts or account policies.
If developers and admins need access to your SQL Server, look at
implementing a VPN, but for sure, don't expose SQL Server directly to the
internet.
Regards
--
Mike Epprecht, Microsoft SQL Server MVP
Zurich, Switzerland
IM: mike@.epprecht.net
MVP Program: http://www.microsoft.com/mvp
Blog: http://www.msmvps.com/epprecht/
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> Hi,
>
> My SQL server is has a public IP address admins and developers can access
> and manage remotely (this is the requirement)
>
> When I monitor the SQL server port I can see some one is brutally trying
> to hack my server. There are almost 70 connections from IP address
> 66.15.173.105 that try to connect to my server.
>
> My guess is he is trying to use brute force technique to find the sa
> password.
>
> What is the best way to prevent that? Can I adjust some settings, to have
> failed logins wait for 10 seconds?
>
> Any help would be appreciated,
> Alan
>
>
>|||Change the port from 1433, block that IP address, make the sa password
something ridiculously difficult (or better yet, switch to Windows
integrated security only) and implement VPN.
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> Hi,
>
> My SQL server is has a public IP address admins and developers can access
> and manage remotely (this is the requirement)
>
> When I monitor the SQL server port I can see some one is brutally trying
> to hack my server. There are almost 70 connections from IP address
> 66.15.173.105 that try to connect to my server.
>
> My guess is he is trying to use brute force technique to find the sa
> password.
>
> What is the best way to prevent that? Can I adjust some settings, to have
> failed logins wait for 10 seconds?
>
> Any help would be appreciated,
> Alan
>
>
>|||You can also use IPSEC & or your firewall and only allow specific IP & PORT
access to your SQL Box.|||Blocking the attacking IP probably won't help -- it's probably a dynamic IP.
This might be painful, but...create a new admin. login with a hard-to-guess
name, use a strong password, and DELETE sa.
-- Jeff
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> Hi,
>
> My SQL server is has a public IP address admins and developers can access
> and manage remotely (this is the requirement)
>
> When I monitor the SQL server port I can see some one is brutally trying
> to hack my server. There are almost 70 connections from IP address
> 66.15.173.105 that try to connect to my server.
>
> My guess is he is trying to use brute force technique to find the sa
> password.
>
> What is the best way to prevent that? Can I adjust some settings, to have
> failed logins wait for 10 seconds?
>
> Any help would be appreciated,
> Alan
>
>
>|||can not delete sa.
"Beige Bond" <BeigeBond@.hotmail.com> wrote in message
news:OvFRYk0TFHA.2556@.TK2MSFTNGP12.phx.gbl...
> Blocking the attacking IP probably won't help -- it's probably a dynamic
IP.
> This might be painful, but...create a new admin. login with a
hard-to-guess
> name, use a strong password, and DELETE sa.
> -- Jeff
> "A.M" <Hate-Spam@.nowhere.com> wrote in message
> news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
access[vbcol=seagreen]
have[vbcol=seagreen]
>|||Apologies for my ignorance. Looks like turning off Mixed Mode Authentication
is the only way to disable sa. Some interesting notes at:
ver_5un8.asp" target="_blank">http://msdn.microsoft.com/library/d...>
ver_5un8.asp
"Dennis Redfield" <dennis_redfield@.newsgroup.nospam> wrote in message
news:eGetLtBUFHA.3644@.TK2MSFTNGP10.phx.gbl...
> can not delete sa.
> "Beige Bond" <BeigeBond@.hotmail.com> wrote in message
> news:OvFRYk0TFHA.2556@.TK2MSFTNGP12.phx.gbl...
> IP.
> hard-to-guess
> access
> have
>|||In addition to all of these suggestions, you can also use the firewall
to block access from all outside IPs except those used by the admins
and developers.
Still the solution is to get a VPN setup and get the SQL Server box
off the internet. To expensive you say? How much will it cost your
company *when* the hacker gets through? I bet it's more than the cost
of some VPNs.
Joe Webb
SQL Server MVP
~~~
Get up to speed quickly with SQLNS
http://www.amazon.com/exec/obidos/t...il/-/0972688811
I support PASS, the Professional Association for SQL Server.
(www.sqlpass.org)
On Sat, 30 Apr 2005 11:39:51 -0400, "Michael C#" <xyz@.abcdef.com>
wrote:
>Change the port from 1433, block that IP address, make the sa password
>something ridiculously difficult (or better yet, switch to Windows
>integrated security only) and implement VPN.
>"A.M" <Hate-Spam@.nowhere.com> wrote in message
>news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
>|||Thank you everyone for your help and suggestions. I convinced development
team to use terminal services instead.
However, lack of proper password policy for SQL server is quite scary! It is
easy build a try/error program to hack sa password based on available
password dictionary databases!
Thanks again,
Alan
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> Hi,
>
> My SQL server is has a public IP address admins and developers can access
> and manage remotely (this is the requirement)
>
> When I monitor the SQL server port I can see some one is brutally trying
> to hack my server. There are almost 70 connections from IP address
> 66.15.173.105 that try to connect to my server.
>
> My guess is he is trying to use brute force technique to find the sa
> password.
>
> What is the best way to prevent that? Can I adjust some settings, to have
> failed logins wait for 10 seconds?
>
> Any help would be appreciated,
> Alan
>
>
>|||That's probably why Windows Integrated is the recommended security model.
Why duplicate all of Windows' password policy functionality in SQL Server
when it's already accessible via Integrated Security?
Are you exposing Terminal Services to the Internet as well, or are you
making them use VPN? Don't forget the Administrator account on your domain
and local machines, which can usually use Terminal Services to log in as
well.
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:%23YGjqxOUFHA.2892@.TK2MSFTNGP14.phx.gbl...
>
> Thank you everyone for your help and suggestions. I convinced development
> team to use terminal services instead.
>
> However, lack of proper password policy for SQL server is quite scary! It
> is easy build a try/error program to hack sa password based on available
> password dictionary databases!
>
> Thanks again,
> Alan
>
> "A.M" <Hate-Spam@.nowhere.com> wrote in message
> news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
>
My SQL server is has a public IP address admins and developers can access
and manage remotely (this is the requirement)
When I monitor the SQL server port I can see some one is brutally trying to
hack my server. There are almost 70 connections from IP address
66.15.173.105 that try to connect to my server.
My guess is he is trying to use brute force technique to find the sa
password.
What is the best way to prevent that? Can I adjust some settings, to have
failed logins wait for 10 seconds?
Any help would be appreciated,
AlanHi
You can't do much as you exposed your SQL Server to the outside world.
At best, you can filter the source IP and port at the router, blocking
66.15.173.105
SQL Server 2000 does not allow account lockouts or account policies.
If developers and admins need access to your SQL Server, look at
implementing a VPN, but for sure, don't expose SQL Server directly to the
internet.
Regards
--
Mike Epprecht, Microsoft SQL Server MVP
Zurich, Switzerland
IM: mike@.epprecht.net
MVP Program: http://www.microsoft.com/mvp
Blog: http://www.msmvps.com/epprecht/
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> Hi,
>
> My SQL server is has a public IP address admins and developers can access
> and manage remotely (this is the requirement)
>
> When I monitor the SQL server port I can see some one is brutally trying
> to hack my server. There are almost 70 connections from IP address
> 66.15.173.105 that try to connect to my server.
>
> My guess is he is trying to use brute force technique to find the sa
> password.
>
> What is the best way to prevent that? Can I adjust some settings, to have
> failed logins wait for 10 seconds?
>
> Any help would be appreciated,
> Alan
>
>
>|||Change the port from 1433, block that IP address, make the sa password
something ridiculously difficult (or better yet, switch to Windows
integrated security only) and implement VPN.
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> Hi,
>
> My SQL server is has a public IP address admins and developers can access
> and manage remotely (this is the requirement)
>
> When I monitor the SQL server port I can see some one is brutally trying
> to hack my server. There are almost 70 connections from IP address
> 66.15.173.105 that try to connect to my server.
>
> My guess is he is trying to use brute force technique to find the sa
> password.
>
> What is the best way to prevent that? Can I adjust some settings, to have
> failed logins wait for 10 seconds?
>
> Any help would be appreciated,
> Alan
>
>
>|||You can also use IPSEC & or your firewall and only allow specific IP & PORT
access to your SQL Box.|||Blocking the attacking IP probably won't help -- it's probably a dynamic IP.
This might be painful, but...create a new admin. login with a hard-to-guess
name, use a strong password, and DELETE sa.
-- Jeff
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> Hi,
>
> My SQL server is has a public IP address admins and developers can access
> and manage remotely (this is the requirement)
>
> When I monitor the SQL server port I can see some one is brutally trying
> to hack my server. There are almost 70 connections from IP address
> 66.15.173.105 that try to connect to my server.
>
> My guess is he is trying to use brute force technique to find the sa
> password.
>
> What is the best way to prevent that? Can I adjust some settings, to have
> failed logins wait for 10 seconds?
>
> Any help would be appreciated,
> Alan
>
>
>|||can not delete sa.
"Beige Bond" <BeigeBond@.hotmail.com> wrote in message
news:OvFRYk0TFHA.2556@.TK2MSFTNGP12.phx.gbl...
> Blocking the attacking IP probably won't help -- it's probably a dynamic
IP.
> This might be painful, but...create a new admin. login with a
hard-to-guess
> name, use a strong password, and DELETE sa.
> -- Jeff
> "A.M" <Hate-Spam@.nowhere.com> wrote in message
> news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
access[vbcol=seagreen]
have[vbcol=seagreen]
>|||Apologies for my ignorance. Looks like turning off Mixed Mode Authentication
is the only way to disable sa. Some interesting notes at:
ver_5un8.asp" target="_blank">http://msdn.microsoft.com/library/d...>
ver_5un8.asp
"Dennis Redfield" <dennis_redfield@.newsgroup.nospam> wrote in message
news:eGetLtBUFHA.3644@.TK2MSFTNGP10.phx.gbl...
> can not delete sa.
> "Beige Bond" <BeigeBond@.hotmail.com> wrote in message
> news:OvFRYk0TFHA.2556@.TK2MSFTNGP12.phx.gbl...
> IP.
> hard-to-guess
> access
> have
>|||In addition to all of these suggestions, you can also use the firewall
to block access from all outside IPs except those used by the admins
and developers.
Still the solution is to get a VPN setup and get the SQL Server box
off the internet. To expensive you say? How much will it cost your
company *when* the hacker gets through? I bet it's more than the cost
of some VPNs.
Joe Webb
SQL Server MVP
~~~
Get up to speed quickly with SQLNS
http://www.amazon.com/exec/obidos/t...il/-/0972688811
I support PASS, the Professional Association for SQL Server.
(www.sqlpass.org)
On Sat, 30 Apr 2005 11:39:51 -0400, "Michael C#" <xyz@.abcdef.com>
wrote:
>Change the port from 1433, block that IP address, make the sa password
>something ridiculously difficult (or better yet, switch to Windows
>integrated security only) and implement VPN.
>"A.M" <Hate-Spam@.nowhere.com> wrote in message
>news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
>|||Thank you everyone for your help and suggestions. I convinced development
team to use terminal services instead.
However, lack of proper password policy for SQL server is quite scary! It is
easy build a try/error program to hack sa password based on available
password dictionary databases!
Thanks again,
Alan
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> Hi,
>
> My SQL server is has a public IP address admins and developers can access
> and manage remotely (this is the requirement)
>
> When I monitor the SQL server port I can see some one is brutally trying
> to hack my server. There are almost 70 connections from IP address
> 66.15.173.105 that try to connect to my server.
>
> My guess is he is trying to use brute force technique to find the sa
> password.
>
> What is the best way to prevent that? Can I adjust some settings, to have
> failed logins wait for 10 seconds?
>
> Any help would be appreciated,
> Alan
>
>
>|||That's probably why Windows Integrated is the recommended security model.
Why duplicate all of Windows' password policy functionality in SQL Server
when it's already accessible via Integrated Security?
Are you exposing Terminal Services to the Internet as well, or are you
making them use VPN? Don't forget the Administrator account on your domain
and local machines, which can usually use Terminal Services to log in as
well.
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:%23YGjqxOUFHA.2892@.TK2MSFTNGP14.phx.gbl...
>
> Thank you everyone for your help and suggestions. I convinced development
> team to use terminal services instead.
>
> However, lack of proper password policy for SQL server is quite scary! It
> is easy build a try/error program to hack sa password based on available
> password dictionary databases!
>
> Thanks again,
> Alan
>
> "A.M" <Hate-Spam@.nowhere.com> wrote in message
> news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
>
Please Help: Someone is hacking my server!
Hi,
My SQL server is has a public IP address admins and developers can access
and manage remotely (this is the requirement)
When I monitor the SQL server port I can see some one is brutally trying to
hack my server. There are almost 70 connections from IP address
66.15.173.105 that try to connect to my server.
My guess is he is trying to use brute force technique to find the sa
password.
What is the best way to prevent that? Can I adjust some settings, to have
failed logins wait for 10 seconds?
Any help would be appreciated,
AlanHi
You can't do much as you exposed your SQL Server to the outside world.
At best, you can filter the source IP and port at the router, blocking
66.15.173.105
SQL Server 2000 does not allow account lockouts or account policies.
If developers and admins need access to your SQL Server, look at
implementing a VPN, but for sure, don't expose SQL Server directly to the
internet.
Regards
--
Mike Epprecht, Microsoft SQL Server MVP
Zurich, Switzerland
IM: mike@.epprecht.net
MVP Program: http://www.microsoft.com/mvp
Blog: http://www.msmvps.com/epprecht/
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> Hi,
>
> My SQL server is has a public IP address admins and developers can access
> and manage remotely (this is the requirement)
>
> When I monitor the SQL server port I can see some one is brutally trying
> to hack my server. There are almost 70 connections from IP address
> 66.15.173.105 that try to connect to my server.
>
> My guess is he is trying to use brute force technique to find the sa
> password.
>
> What is the best way to prevent that? Can I adjust some settings, to have
> failed logins wait for 10 seconds?
>
> Any help would be appreciated,
> Alan
>
>
>|||Change the port from 1433, block that IP address, make the sa password
something ridiculously difficult (or better yet, switch to Windows
integrated security only) and implement VPN.
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> Hi,
>
> My SQL server is has a public IP address admins and developers can access
> and manage remotely (this is the requirement)
>
> When I monitor the SQL server port I can see some one is brutally trying
> to hack my server. There are almost 70 connections from IP address
> 66.15.173.105 that try to connect to my server.
>
> My guess is he is trying to use brute force technique to find the sa
> password.
>
> What is the best way to prevent that? Can I adjust some settings, to have
> failed logins wait for 10 seconds?
>
> Any help would be appreciated,
> Alan
>
>
>|||You can also use IPSEC & or your firewall and only allow specific IP & PORT
access to your SQL Box.|||Blocking the attacking IP probably won't help -- it's probably a dynamic IP.
This might be painful, but...create a new admin. login with a hard-to-guess
name, use a strong password, and DELETE sa.
-- Jeff
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> Hi,
>
> My SQL server is has a public IP address admins and developers can access
> and manage remotely (this is the requirement)
>
> When I monitor the SQL server port I can see some one is brutally trying
> to hack my server. There are almost 70 connections from IP address
> 66.15.173.105 that try to connect to my server.
>
> My guess is he is trying to use brute force technique to find the sa
> password.
>
> What is the best way to prevent that? Can I adjust some settings, to have
> failed logins wait for 10 seconds?
>
> Any help would be appreciated,
> Alan
>
>
>|||can not delete sa.
"Beige Bond" <BeigeBond@.hotmail.com> wrote in message
news:OvFRYk0TFHA.2556@.TK2MSFTNGP12.phx.gbl...
> Blocking the attacking IP probably won't help -- it's probably a dynamic
IP.
> This might be painful, but...create a new admin. login with a
hard-to-guess
> name, use a strong password, and DELETE sa.
> -- Jeff
> "A.M" <Hate-Spam@.nowhere.com> wrote in message
> news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> > Hi,
> >
> >
> >
> > My SQL server is has a public IP address admins and developers can
access
> > and manage remotely (this is the requirement)
> >
> >
> >
> > When I monitor the SQL server port I can see some one is brutally trying
> > to hack my server. There are almost 70 connections from IP address
> > 66.15.173.105 that try to connect to my server.
> >
> >
> >
> > My guess is he is trying to use brute force technique to find the sa
> > password.
> >
> >
> >
> > What is the best way to prevent that? Can I adjust some settings, to
have
> > failed logins wait for 10 seconds?
> >
> >
> >
> > Any help would be appreciated,
> >
> > Alan
> >
> >
> >
> >
> >
> >
>|||Apologies for my ignorance. Looks like turning off Mixed Mode Authentication
is the only way to disable sa. Some interesting notes at:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/adminsql/ad_1_server_5un8.asp
"Dennis Redfield" <dennis_redfield@.newsgroup.nospam> wrote in message
news:eGetLtBUFHA.3644@.TK2MSFTNGP10.phx.gbl...
> can not delete sa.
> "Beige Bond" <BeigeBond@.hotmail.com> wrote in message
> news:OvFRYk0TFHA.2556@.TK2MSFTNGP12.phx.gbl...
>> Blocking the attacking IP probably won't help -- it's probably a dynamic
> IP.
>> This might be painful, but...create a new admin. login with a
> hard-to-guess
>> name, use a strong password, and DELETE sa.
>> -- Jeff
>> "A.M" <Hate-Spam@.nowhere.com> wrote in message
>> news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
>> > Hi,
>> >
>> >
>> >
>> > My SQL server is has a public IP address admins and developers can
> access
>> > and manage remotely (this is the requirement)
>> >
>> >
>> >
>> > When I monitor the SQL server port I can see some one is brutally
>> > trying
>> > to hack my server. There are almost 70 connections from IP address
>> > 66.15.173.105 that try to connect to my server.
>> >
>> >
>> >
>> > My guess is he is trying to use brute force technique to find the sa
>> > password.
>> >
>> >
>> >
>> > What is the best way to prevent that? Can I adjust some settings, to
> have
>> > failed logins wait for 10 seconds?
>> >
>> >
>> >
>> > Any help would be appreciated,
>> >
>> > Alan
>> >
>> >
>> >
>> >
>> >
>> >
>>
>|||In addition to all of these suggestions, you can also use the firewall
to block access from all outside IPs except those used by the admins
and developers.
Still the solution is to get a VPN setup and get the SQL Server box
off the internet. To expensive you say? How much will it cost your
company *when* the hacker gets through? I bet it's more than the cost
of some VPNs.
Joe Webb
SQL Server MVP
~~~
Get up to speed quickly with SQLNS
http://www.amazon.com/exec/obidos/tg/detail/-/0972688811
I support PASS, the Professional Association for SQL Server.
(www.sqlpass.org)
On Sat, 30 Apr 2005 11:39:51 -0400, "Michael C#" <xyz@.abcdef.com>
wrote:
>Change the port from 1433, block that IP address, make the sa password
>something ridiculously difficult (or better yet, switch to Windows
>integrated security only) and implement VPN.
>"A.M" <Hate-Spam@.nowhere.com> wrote in message
>news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
>> Hi,
>>
>> My SQL server is has a public IP address admins and developers can access
>> and manage remotely (this is the requirement)
>>
>> When I monitor the SQL server port I can see some one is brutally trying
>> to hack my server. There are almost 70 connections from IP address
>> 66.15.173.105 that try to connect to my server.
>>
>> My guess is he is trying to use brute force technique to find the sa
>> password.
>>
>> What is the best way to prevent that? Can I adjust some settings, to have
>> failed logins wait for 10 seconds?
>>
>> Any help would be appreciated,
>> Alan
>>
>>
>>
>|||Thank you everyone for your help and suggestions. I convinced development
team to use terminal services instead.
However, lack of proper password policy for SQL server is quite scary! It is
easy build a try/error program to hack sa password based on available
password dictionary databases!
Thanks again,
Alan
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> Hi,
>
> My SQL server is has a public IP address admins and developers can access
> and manage remotely (this is the requirement)
>
> When I monitor the SQL server port I can see some one is brutally trying
> to hack my server. There are almost 70 connections from IP address
> 66.15.173.105 that try to connect to my server.
>
> My guess is he is trying to use brute force technique to find the sa
> password.
>
> What is the best way to prevent that? Can I adjust some settings, to have
> failed logins wait for 10 seconds?
>
> Any help would be appreciated,
> Alan
>
>
>|||That's probably why Windows Integrated is the recommended security model.
Why duplicate all of Windows' password policy functionality in SQL Server
when it's already accessible via Integrated Security?
Are you exposing Terminal Services to the Internet as well, or are you
making them use VPN? Don't forget the Administrator account on your domain
and local machines, which can usually use Terminal Services to log in as
well.
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:%23YGjqxOUFHA.2892@.TK2MSFTNGP14.phx.gbl...
>
> Thank you everyone for your help and suggestions. I convinced development
> team to use terminal services instead.
>
> However, lack of proper password policy for SQL server is quite scary! It
> is easy build a try/error program to hack sa password based on available
> password dictionary databases!
>
> Thanks again,
> Alan
>
> "A.M" <Hate-Spam@.nowhere.com> wrote in message
> news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
>> Hi,
>>
>> My SQL server is has a public IP address admins and developers can access
>> and manage remotely (this is the requirement)
>>
>> When I monitor the SQL server port I can see some one is brutally trying
>> to hack my server. There are almost 70 connections from IP address
>> 66.15.173.105 that try to connect to my server.
>>
>> My guess is he is trying to use brute force technique to find the sa
>> password.
>>
>> What is the best way to prevent that? Can I adjust some settings, to have
>> failed logins wait for 10 seconds?
>>
>> Any help would be appreciated,
>> Alan
>>
>>
>>
>
My SQL server is has a public IP address admins and developers can access
and manage remotely (this is the requirement)
When I monitor the SQL server port I can see some one is brutally trying to
hack my server. There are almost 70 connections from IP address
66.15.173.105 that try to connect to my server.
My guess is he is trying to use brute force technique to find the sa
password.
What is the best way to prevent that? Can I adjust some settings, to have
failed logins wait for 10 seconds?
Any help would be appreciated,
AlanHi
You can't do much as you exposed your SQL Server to the outside world.
At best, you can filter the source IP and port at the router, blocking
66.15.173.105
SQL Server 2000 does not allow account lockouts or account policies.
If developers and admins need access to your SQL Server, look at
implementing a VPN, but for sure, don't expose SQL Server directly to the
internet.
Regards
--
Mike Epprecht, Microsoft SQL Server MVP
Zurich, Switzerland
IM: mike@.epprecht.net
MVP Program: http://www.microsoft.com/mvp
Blog: http://www.msmvps.com/epprecht/
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> Hi,
>
> My SQL server is has a public IP address admins and developers can access
> and manage remotely (this is the requirement)
>
> When I monitor the SQL server port I can see some one is brutally trying
> to hack my server. There are almost 70 connections from IP address
> 66.15.173.105 that try to connect to my server.
>
> My guess is he is trying to use brute force technique to find the sa
> password.
>
> What is the best way to prevent that? Can I adjust some settings, to have
> failed logins wait for 10 seconds?
>
> Any help would be appreciated,
> Alan
>
>
>|||Change the port from 1433, block that IP address, make the sa password
something ridiculously difficult (or better yet, switch to Windows
integrated security only) and implement VPN.
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> Hi,
>
> My SQL server is has a public IP address admins and developers can access
> and manage remotely (this is the requirement)
>
> When I monitor the SQL server port I can see some one is brutally trying
> to hack my server. There are almost 70 connections from IP address
> 66.15.173.105 that try to connect to my server.
>
> My guess is he is trying to use brute force technique to find the sa
> password.
>
> What is the best way to prevent that? Can I adjust some settings, to have
> failed logins wait for 10 seconds?
>
> Any help would be appreciated,
> Alan
>
>
>|||You can also use IPSEC & or your firewall and only allow specific IP & PORT
access to your SQL Box.|||Blocking the attacking IP probably won't help -- it's probably a dynamic IP.
This might be painful, but...create a new admin. login with a hard-to-guess
name, use a strong password, and DELETE sa.
-- Jeff
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> Hi,
>
> My SQL server is has a public IP address admins and developers can access
> and manage remotely (this is the requirement)
>
> When I monitor the SQL server port I can see some one is brutally trying
> to hack my server. There are almost 70 connections from IP address
> 66.15.173.105 that try to connect to my server.
>
> My guess is he is trying to use brute force technique to find the sa
> password.
>
> What is the best way to prevent that? Can I adjust some settings, to have
> failed logins wait for 10 seconds?
>
> Any help would be appreciated,
> Alan
>
>
>|||can not delete sa.
"Beige Bond" <BeigeBond@.hotmail.com> wrote in message
news:OvFRYk0TFHA.2556@.TK2MSFTNGP12.phx.gbl...
> Blocking the attacking IP probably won't help -- it's probably a dynamic
IP.
> This might be painful, but...create a new admin. login with a
hard-to-guess
> name, use a strong password, and DELETE sa.
> -- Jeff
> "A.M" <Hate-Spam@.nowhere.com> wrote in message
> news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> > Hi,
> >
> >
> >
> > My SQL server is has a public IP address admins and developers can
access
> > and manage remotely (this is the requirement)
> >
> >
> >
> > When I monitor the SQL server port I can see some one is brutally trying
> > to hack my server. There are almost 70 connections from IP address
> > 66.15.173.105 that try to connect to my server.
> >
> >
> >
> > My guess is he is trying to use brute force technique to find the sa
> > password.
> >
> >
> >
> > What is the best way to prevent that? Can I adjust some settings, to
have
> > failed logins wait for 10 seconds?
> >
> >
> >
> > Any help would be appreciated,
> >
> > Alan
> >
> >
> >
> >
> >
> >
>|||Apologies for my ignorance. Looks like turning off Mixed Mode Authentication
is the only way to disable sa. Some interesting notes at:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/adminsql/ad_1_server_5un8.asp
"Dennis Redfield" <dennis_redfield@.newsgroup.nospam> wrote in message
news:eGetLtBUFHA.3644@.TK2MSFTNGP10.phx.gbl...
> can not delete sa.
> "Beige Bond" <BeigeBond@.hotmail.com> wrote in message
> news:OvFRYk0TFHA.2556@.TK2MSFTNGP12.phx.gbl...
>> Blocking the attacking IP probably won't help -- it's probably a dynamic
> IP.
>> This might be painful, but...create a new admin. login with a
> hard-to-guess
>> name, use a strong password, and DELETE sa.
>> -- Jeff
>> "A.M" <Hate-Spam@.nowhere.com> wrote in message
>> news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
>> > Hi,
>> >
>> >
>> >
>> > My SQL server is has a public IP address admins and developers can
> access
>> > and manage remotely (this is the requirement)
>> >
>> >
>> >
>> > When I monitor the SQL server port I can see some one is brutally
>> > trying
>> > to hack my server. There are almost 70 connections from IP address
>> > 66.15.173.105 that try to connect to my server.
>> >
>> >
>> >
>> > My guess is he is trying to use brute force technique to find the sa
>> > password.
>> >
>> >
>> >
>> > What is the best way to prevent that? Can I adjust some settings, to
> have
>> > failed logins wait for 10 seconds?
>> >
>> >
>> >
>> > Any help would be appreciated,
>> >
>> > Alan
>> >
>> >
>> >
>> >
>> >
>> >
>>
>|||In addition to all of these suggestions, you can also use the firewall
to block access from all outside IPs except those used by the admins
and developers.
Still the solution is to get a VPN setup and get the SQL Server box
off the internet. To expensive you say? How much will it cost your
company *when* the hacker gets through? I bet it's more than the cost
of some VPNs.
Joe Webb
SQL Server MVP
~~~
Get up to speed quickly with SQLNS
http://www.amazon.com/exec/obidos/tg/detail/-/0972688811
I support PASS, the Professional Association for SQL Server.
(www.sqlpass.org)
On Sat, 30 Apr 2005 11:39:51 -0400, "Michael C#" <xyz@.abcdef.com>
wrote:
>Change the port from 1433, block that IP address, make the sa password
>something ridiculously difficult (or better yet, switch to Windows
>integrated security only) and implement VPN.
>"A.M" <Hate-Spam@.nowhere.com> wrote in message
>news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
>> Hi,
>>
>> My SQL server is has a public IP address admins and developers can access
>> and manage remotely (this is the requirement)
>>
>> When I monitor the SQL server port I can see some one is brutally trying
>> to hack my server. There are almost 70 connections from IP address
>> 66.15.173.105 that try to connect to my server.
>>
>> My guess is he is trying to use brute force technique to find the sa
>> password.
>>
>> What is the best way to prevent that? Can I adjust some settings, to have
>> failed logins wait for 10 seconds?
>>
>> Any help would be appreciated,
>> Alan
>>
>>
>>
>|||Thank you everyone for your help and suggestions. I convinced development
team to use terminal services instead.
However, lack of proper password policy for SQL server is quite scary! It is
easy build a try/error program to hack sa password based on available
password dictionary databases!
Thanks again,
Alan
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
> Hi,
>
> My SQL server is has a public IP address admins and developers can access
> and manage remotely (this is the requirement)
>
> When I monitor the SQL server port I can see some one is brutally trying
> to hack my server. There are almost 70 connections from IP address
> 66.15.173.105 that try to connect to my server.
>
> My guess is he is trying to use brute force technique to find the sa
> password.
>
> What is the best way to prevent that? Can I adjust some settings, to have
> failed logins wait for 10 seconds?
>
> Any help would be appreciated,
> Alan
>
>
>|||That's probably why Windows Integrated is the recommended security model.
Why duplicate all of Windows' password policy functionality in SQL Server
when it's already accessible via Integrated Security?
Are you exposing Terminal Services to the Internet as well, or are you
making them use VPN? Don't forget the Administrator account on your domain
and local machines, which can usually use Terminal Services to log in as
well.
"A.M" <Hate-Spam@.nowhere.com> wrote in message
news:%23YGjqxOUFHA.2892@.TK2MSFTNGP14.phx.gbl...
>
> Thank you everyone for your help and suggestions. I convinced development
> team to use terminal services instead.
>
> However, lack of proper password policy for SQL server is quite scary! It
> is easy build a try/error program to hack sa password based on available
> password dictionary databases!
>
> Thanks again,
> Alan
>
> "A.M" <Hate-Spam@.nowhere.com> wrote in message
> news:e%235pS4YTFHA.612@.TK2MSFTNGP12.phx.gbl...
>> Hi,
>>
>> My SQL server is has a public IP address admins and developers can access
>> and manage remotely (this is the requirement)
>>
>> When I monitor the SQL server port I can see some one is brutally trying
>> to hack my server. There are almost 70 connections from IP address
>> 66.15.173.105 that try to connect to my server.
>>
>> My guess is he is trying to use brute force technique to find the sa
>> password.
>>
>> What is the best way to prevent that? Can I adjust some settings, to have
>> failed logins wait for 10 seconds?
>>
>> Any help would be appreciated,
>> Alan
>>
>>
>>
>
Subscribe to:
Posts (Atom)