Sql Server Login failed for user 'sa'. [CLINET: XXX:XXX:XXX:XXX]

tags:

views:

67

answers:

1

Q:

Sql Server Login failed for user 'sa'. [CLINET: XXX:XXX:XXX:XXX]

Hi,

We installed SQL Server 2005 Enterprise Edition in Windows 2003 with all altest SP for both SQL Server & Windows.

SQL Server is running perfectly without any problem for sometime.

Suddenly it crashed. when look into EventViewer there per second 5 to 10 entries saying that

Login failed for user 'sa'. [CLINET: XXX:XXX:XXX:XXX]

with two different IPs.

Whole event viewer filled with the above entries from two IPs. Is it any security problem?

thanks

nRk

+1 A:

If those IPs aren't from computers you're expecting to be connecting to SQL Server, you may have accidentally opened the server up to the internet without meaning to (which is likely a security problem).

Make sure you have a firewall of some kind in place to protect the internet at large from connecting to your database server.

Jonathan 2009-11-25 06:19:40

Thanks for the reply, yeah, those two ips not related to our network, those are public ips, I am able to ping those ips. If I want to stop those connecting to my sql server instance.. Can I stop those connecting to my machine sql server?

nRk 2009-11-25 06:30:39

Use a firewall of some kind. Preferably a hardware firewall at the network perimeter (since I don't think the Windows Firewall was in Windows 2003), though a third-party software firewall should be able to do it too.

Jonathan 2009-11-25 07:07:11

Also, until you get it secured, I'd recommend stopping the SQL Server service (or taking the whole machine offline). If that machine doesn't have recent patches installed, running W2K3 on the open internet is *not* a good idea.

Jonathan 2009-11-25 07:08:06

ansaurus

tags:

views:

answers:

Sql Server Login failed for user 'sa'. [CLINET: XXX:XXX:XXX:XXX]

related questions