Possible attack on my SQL server?
Posted
by
erizias
on Server Fault
See other posts from Server Fault
or by erizias
Published on 2011-11-08T12:14:54Z
Indexed on
2012/03/28
11:31 UTC
Read the original article
Hit count: 228
sql-server-2008
Checking my SQL Server log I see several entries like this:
Date: 08-11-2011 11:40:42
Source: Logon
Message: Login failed for user 'sa'. Reason: Password did not match for the login provided. [CLIENT: 56.60.156.50]
Date: 08-11-2011 11:40:42
Source: Logon
Message: Error: 18456. Severity: 14. State: 8.
Date: 08-11-2011 11:40:41
Source: Logon
Message: Login failed for user 'sa'. Reason: Password did not match for the login provided. [CLIENT: 56.60.156.50]
Date: 08-11-2011 11:40:41
Source: Logon
Message: Error: 18456. Severity: 14. State: 8.
And so on.. Is this a possible attack on my SQL Server from the chineese???! I looked up the IP adress, at ip-lookup.net which stated it was chineese.
And what to do? - Block the IP adress in the firewall? - Delete the user sa?
And how do I protect my web server the best?! :)
Thanks in advance!
© Server Fault or respective owner