January 24, 2006 at 6:55 am
Sql server 2005 Enterprise with Windows 2003 Server
Description:
In my Event Viewer :
Login failed for user 'sa'. [CLIENT: 211.233.38.77]
each 5 seconds.
How I can stop this?
thank you
January 24, 2006 at 7:02 am
I can ping that IP so it's probably coming from outside your network. On your firewall you should be blocking port 1433.
February 14, 2006 at 8:42 am
Search results for: 211.233.38.77
OrgName: Asia Pacific Network Information Centre
OrgID: APNIC
Address: PO Box 2131
City: Milton
StateProv: QLD
PostalCode: 4064
Country: AU
If this access really is coming over the net, then your advice still holds.
February 14, 2006 at 9:09 am
Hi Jose - tell us you blocked 1433
February 14, 2006 at 9:24 am
I do not blocked 1433, for now I uncheked Allow remote connections to this server
February 15, 2006 at 5:03 am
If 1433 isn't blocked, then the firewall is unlikely to be implementing the drop all/any default rule, so the box'll be rooted through other means.
Can I ask; what is out there on the net that needs to talk directly to the SQL Server on 1433?
Viewing 6 posts - 1 through 5 (of 5 total)
You must be logged in to reply to this topic. Login to reply