How can I throttle failed logins in SQL Server 2005?

Question

I believe my server has been the ongoing target of a brute-force attack on SQL Server 2005 (SQLExpress). My Event Viewer log is filled with "Failure Audit" messages for SQL Server. The attempts usually last for an hour or two, with 1-2 seconds between attempts.

Login failed for user 'sa' [CLIENT: 222.169.224.163]

Event ID: 18456. Based on matching entries in the SQL Server log, I have found that each login fails due to a mismatched password. I have also seen attempts for other users, including 'administrator' and 'administrador'. Each session comes from a different IP address, and are from countries like Italy and China.

What countermeasures can be taken? I do not want to lock out the user account, because then my site and applications will not have access to the server. Is there a way to throttle login attempts through SQL Server 2005? E.g. geometrically increase the 'wait period' between failed login attempts?

Answer 1

There isn't a way to throttle logon attempts to SQL server that I'm aware of. However, I'm kind of curious how internet users are able to get that far. Aren't you behind a firewall? That is some scary access and should be remedied ASAP.

My web servers are behind a firewall and the only ports allowed access are 80 and 443.

Answer 2

While this is not an answer to your question, exposing the database server to Internet was never a good practice. Provide web services to access the data in a safely manner, and hide the server behind firewall.

Answer 3

Consider blocking incoming connections on the SQL Server port (1433) using a firewall.

Answer 4

A quick fix is renaming sa account and modify the connection parameters on services that depend on this Sql Server.

ALTER LOGIN sa DISABLE;

ALTER LOGIN sa WITH NAME = [sys12-21admin];

(Of course, choose another name than the one suggested.)

For more details http://blogs.msdn.com/sqltips/archive/2005/08/27/457184.aspx

By increasing the 'wait period' between failed log in attempts you could deny proper access to Sql Server.

As far as I understand the applications are using the "sa" log in to do daily tasks adn this could get the account locked. Just in case this happens use http://www.windowsecurity.com/articles/Hacking_an_SQL_Server.html

This is another security concern of course reason for which you should try to stop access as soon as possible as sugested in earlier posts.