Solved

How to Restrict access by IP address range to SQL Box

Posted on 2004-08-30
12
1,426 Views
Last Modified: 2008-02-01

I have inherited a SQL machine that has both internal (192.168.x.x) and public internet ip addresses, with web sites, assigned to it. The machine is constantly hammered by brute force connections to MS-SQL-S with logon attempts.

Is there a way to have SQL only bind to the internal IP address ?

- Or -

Can I limited the connections to the public IP address to only HTTP or FTP ?

Or something of this sort that will remove the exposure of the SQL server to the world at large ?

Thanks,

TMacT


0
Comment
Question by:TMacT
12 Comments
 
LVL 5

Author Comment

by:TMacT
ID: 11936466

Note: this machine a stand-alone on a DSL link. My client does not have, and is not interested at this point, in a firewall.

0
 
LVL 11

Accepted Solution

by:
kabaam earned 250 total points
ID: 11936515
Microsoft SQL Server
a firewall can be configured to allow only the ports you want Such as 80 for http.  Or you can block the sql specific ports.


http://www.microsoft.com/smallbusiness/gtm/securityguidance/articles/ref_net_ports_ms_prod.mspx
Microsoft SQL Server 2000 provides a powerful and comprehensive data management platform. The ports used by each instance of SQL Server can be configured through the Server Network Utility.

System Service Name SQLSERVR

Application protocol Protocol Port
SQL over TCP
 TCP
 1433
 
SQL Probe
 UDP
 1434
 
0
 
LVL 5

Author Comment

by:TMacT
ID: 11936519
::: More info :::
SQL 7.0, Windows 2K SP4, Single NIC (Can install another if need to filter by NIC). Single Private address. Multiple Public addresses.

0
Migrating Your Company's PCs

To keep pace with competitors, businesses must keep employees productive, and that means providing them with the latest technology. This document provides the tips and tricks you need to help you migrate an outdated PC fleet to new desktops, laptops, and tablets.

 
LVL 5

Author Comment

by:TMacT
ID: 11936574
kabaam,

Thanks for your quick answer. Unfortunately, I can not configure a firewall at this time, and the Server Network Utility would let me change the ports, but not restrict access to the IP Address. I do not want to change the SQL port as the system is in production.

Still open ...
0
 
LVL 6

Assisted Solution

by:gwalkeriq
gwalkeriq earned 250 total points
ID: 11937498
Actually, even though there are other solutions, the recommended solution is to reconfigure the windows NT Sever hosting your database  so that it is not visible to the Internet at all. I.e, put the DB server on a subnet that is private. This not only avoids the hammering from the internet, it also closes a significant security hole. Leaving any machine exposed to the Internet without cause is just asking for trouble.
0
 
LVL 5

Author Comment

by:TMacT
ID: 11941168
Hi gwalkeriq,

>> put the DB server on a subnet that is private

My clients SQL server/web server is already running, and they just want to prevent external connections to the SQL. I need to put some quick solutions on the SQL box, then I can discuss moving the SQL to another system and getting a firewall.

... TMacT
0
 
LVL 18

Expert Comment

by:ShogunWade
ID: 11943843
IMHO,  If your client is not interested in getting a firewall then he deserved to be hit.   The wole world knows about 1433 and xp_cmdshell !!!!!!

0
 
LVL 5

Author Comment

by:TMacT
ID: 12160000
Hi TheLearned One,

While I appreciate the effort from the experts above, none of them actually answered the question I was asking.

After being in this business for 15 years, I tire of answers from hotshots like ShogunWade who do not demonstrate any experience working to resolve an issue within the stated limitations.

I was specifically asking for help implementing IP security on a SQL /  Win2K server. I did not get that answer. For everyone's reference, I found the solution here (http://www.analogx.com/contents/articles/ipsec.htm) , and have implemented it. I now have the breathing room to rework the network.

Althought I answered my own question, I am unlikely to ask 110 questions and use up my all my available points, so please split the points between kabaam, and qwalkeriq, who at least provided constructive alternatives and suggestions.

... TMacT

0
 
LVL 18

Expert Comment

by:ShogunWade
ID: 12160107
Tmac,   Im sorry that you "tire of answers from hotshots like ShogunWade"   However perhaphs I shouldnt have had to make this observation to someone "being in this business for 15 years"
0

Featured Post

Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Server 2012 VS Server 2016 for SQL Cluster 4 40
Need help on t-sql 2012 10 53
Unable to Uninstall Visual Studio 2015 7 23
sql server service accounts 4 19
Slowly Changing Dimension Transformation component in data task flow is very useful for us to manage and control how data changes in SSIS.
I have a large data set and a SSIS package. How can I load this file in multi threading?
Via a live example, show how to backup a database, simulate a failure backup the tail of the database transaction log and perform the restore.
Viewers will learn how to use the SELECT statement in SQL to return specific rows and columns, with various degrees of sorting and limits in place.

815 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

8 Experts available now in Live!

Get 1:1 Help Now