Solved

How to Restrict access by IP address range to SQL Box

Posted on 2004-08-30
12
1,421 Views
Last Modified: 2008-02-01

I have inherited a SQL machine that has both internal (192.168.x.x) and public internet ip addresses, with web sites, assigned to it. The machine is constantly hammered by brute force connections to MS-SQL-S with logon attempts.

Is there a way to have SQL only bind to the internal IP address ?

- Or -

Can I limited the connections to the public IP address to only HTTP or FTP ?

Or something of this sort that will remove the exposure of the SQL server to the world at large ?

Thanks,

TMacT


0
Comment
Question by:TMacT
12 Comments
 
LVL 5

Author Comment

by:TMacT
ID: 11936466

Note: this machine a stand-alone on a DSL link. My client does not have, and is not interested at this point, in a firewall.

0
 
LVL 11

Accepted Solution

by:
kabaam earned 250 total points
ID: 11936515
Microsoft SQL Server
a firewall can be configured to allow only the ports you want Such as 80 for http.  Or you can block the sql specific ports.


http://www.microsoft.com/smallbusiness/gtm/securityguidance/articles/ref_net_ports_ms_prod.mspx
Microsoft SQL Server 2000 provides a powerful and comprehensive data management platform. The ports used by each instance of SQL Server can be configured through the Server Network Utility.

System Service Name SQLSERVR

Application protocol Protocol Port
SQL over TCP
 TCP
 1433
 
SQL Probe
 UDP
 1434
 
0
 
LVL 5

Author Comment

by:TMacT
ID: 11936519
::: More info :::
SQL 7.0, Windows 2K SP4, Single NIC (Can install another if need to filter by NIC). Single Private address. Multiple Public addresses.

0
 
LVL 5

Author Comment

by:TMacT
ID: 11936574
kabaam,

Thanks for your quick answer. Unfortunately, I can not configure a firewall at this time, and the Server Network Utility would let me change the ports, but not restrict access to the IP Address. I do not want to change the SQL port as the system is in production.

Still open ...
0
Complete Microsoft Windows PC® & Mac Backup

Backup and recovery solutions to protect all your PCs & Mac– on-premises or in remote locations. Acronis backs up entire PC or Mac with patented reliable disk imaging technology and you will be able to restore workstations to a new, dissimilar hardware in minutes.

 
LVL 6

Assisted Solution

by:gwalkeriq
gwalkeriq earned 250 total points
ID: 11937498
Actually, even though there are other solutions, the recommended solution is to reconfigure the windows NT Sever hosting your database  so that it is not visible to the Internet at all. I.e, put the DB server on a subnet that is private. This not only avoids the hammering from the internet, it also closes a significant security hole. Leaving any machine exposed to the Internet without cause is just asking for trouble.
0
 
LVL 5

Author Comment

by:TMacT
ID: 11941168
Hi gwalkeriq,

>> put the DB server on a subnet that is private

My clients SQL server/web server is already running, and they just want to prevent external connections to the SQL. I need to put some quick solutions on the SQL box, then I can discuss moving the SQL to another system and getting a firewall.

... TMacT
0
 
LVL 18

Expert Comment

by:ShogunWade
ID: 11943843
IMHO,  If your client is not interested in getting a firewall then he deserved to be hit.   The wole world knows about 1433 and xp_cmdshell !!!!!!

0
 
LVL 5

Author Comment

by:TMacT
ID: 12160000
Hi TheLearned One,

While I appreciate the effort from the experts above, none of them actually answered the question I was asking.

After being in this business for 15 years, I tire of answers from hotshots like ShogunWade who do not demonstrate any experience working to resolve an issue within the stated limitations.

I was specifically asking for help implementing IP security on a SQL /  Win2K server. I did not get that answer. For everyone's reference, I found the solution here (http://www.analogx.com/contents/articles/ipsec.htm) , and have implemented it. I now have the breathing room to rework the network.

Althought I answered my own question, I am unlikely to ask 110 questions and use up my all my available points, so please split the points between kabaam, and qwalkeriq, who at least provided constructive alternatives and suggestions.

... TMacT

0
 
LVL 18

Expert Comment

by:ShogunWade
ID: 12160107
Tmac,   Im sorry that you "tire of answers from hotshots like ShogunWade"   However perhaphs I shouldnt have had to make this observation to someone "being in this business for 15 years"
0

Featured Post

What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

Suggested Solutions

When you hear the word proxy, you may become apprehensive. This article will help you to understand Proxy and when it is useful. Let's talk Proxy for SQL Server. (Not in terms of Internet access.) Typically, you'll run into this type of problem w…
This article explains how to reset the password of the sa account on a Microsoft SQL Server.  The steps in this article work in SQL 2005, 2008, 2008 R2, 2012, 2014 and 2016.
Using examples as well as descriptions, and references to Books Online, show the documentation available for date manipulation functions and by using a select few of these functions, show how date based data can be manipulated with these functions.
Viewers will learn how to use the SELECT statement in SQL and will be exposed to the many uses the SELECT statement has.

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

23 Experts available now in Live!

Get 1:1 Help Now