Possible attack on my SQL server?

Posted by erizias on Server Fault See other posts from Server Fault or by erizias
Published on 2011-11-08T12:14:54Z Indexed on 2012/03/28 11:31 UTC
Read the original article Hit count: 225

Filed under:

Checking my SQL Server log I see several entries like this:

Date: 08-11-2011 11:40:42
Source: Logon
Message: Login failed for user 'sa'. Reason: Password did not match for the login provided. [CLIENT: 56.60.156.50]
Date: 08-11-2011 11:40:42
Source: Logon
Message: Error: 18456. Severity: 14. State: 8.


Date: 08-11-2011 11:40:41
Source: Logon
Message: Login failed for user 'sa'. Reason: Password did not match for the login provided. [CLIENT: 56.60.156.50]
Date: 08-11-2011 11:40:41
Source: Logon
Message: Error: 18456. Severity: 14. State: 8.

And so on.. Is this a possible attack on my SQL Server from the chineese???! I looked up the IP adress, at ip-lookup.net which stated it was chineese.

And what to do? - Block the IP adress in the firewall? - Delete the user sa?

And how do I protect my web server the best?! :)

Thanks in advance!

© Server Fault or respective owner

Related posts about sql-server-2008