Login failed for user 'sa'

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

Ian Bell - 28 Apr 2005 10:12 GMT

Hi,

We are getting a lot of entries in the Windows event log indicating 'Login
failed for user 'sa'' and 'root'. It seems like an obvious hack attempt but
is there any way of determining the source (ip address) of these attempts. I
can't understand why SQL doesn't log the ip address of login attempts.

Thanks - Ian

Reply to this Message

Jens Süßmeyer - 28 Apr 2005 11:25 GMT

http://www.appsecinc.com/products/appradar/mssql/faq.html

HTH, Jens Suessmeyer.

> Hi,
>
[quoted text clipped - 5 lines]
>
> Thanks - Ian

Reply to this Message

Donna Lambert - 28 Apr 2005 17:36 GMT

Yes, you are getting hacked...no SQL doesn't record the address of the attempt.
Throw Network monitor on the SQL server and start sniffing all inbound
traffic. Look for the failed SA attempts. Chances are it's outside your
firewall anyway, and you should be able to ask your Network admin to give you
a log of all inbound traffic to the SQL IP address.
If you haven't moved SQL off port 1433, do so, and block all inbound 1433
traffic!!!

Donna Lambert

> Hi,
>
[quoted text clipped - 4 lines]
>
> Thanks - Ian

Reply to this Message