Newbie Questions - To Be Expected? - UK Web Hosting | Dedicated Server Windows and Linux VPS Forum

**cbjroms** · #1 (**permalink**) 02-01-2008, 13:19

Looking at the Event Viewer on my vps, it is clear from a mass of error messages that something tried to get into both my server and sqlexpress (1000s of sa login errors around midnight) database last night.

With previous websites I not had any involvement with the webserver. So I am now wondering whether this is a fairy 'normal' occurrence or is someone out there targetting my website?

Grateful for some advice please.

Chris

**eUK-Nick** · #2 (**permalink**) 02-01-2008, 13:22

Hello Chris,

I will have this checked up by the VPS team. Will get back to you shortly.

**eUK-Nick** · #3 (**permalink**) 02-01-2008, 13:37

Chris,

The VPS team opines that we change the port number for MS-SQL. Please open a support ticket mentioning that you want the port changed & we will have it done for you.

Windows firewall would also be installed.

**eUK-Martin** · #4 (**permalink**) 02-01-2008, 13:39

Hello Chris,

No this is not normal at all. Please disable the remote connections from the SQL server properties and the problem should be resolved. Additionally I would also recommend to have a tough password for the user 'sa'.

**cbjroms** · #5 (**permalink**) 02-01-2008, 14:03

Hi Nick,

Thanks for this.

I did put a ticket (#CIT-51127-140) into support and was advised 'If you get too many sa login failed errors then it will only mean that some is trying to brute force your sa password.'

Thus my question as to whether this is a normal occurence.

Chris

**cbjroms** · #6 (**permalink**) 02-01-2008, 14:54

Thanks both,

Just to recap the advice is to:

a)Change the port number for MS-SQL - what effect will this have on my website?
b) Windows firewall should also be installed - is this not standard?
c) Disable the remote connections from the SQL server properties - will this impact on my ability to access the database via SSMSSE?

Thanks

Chris

**eUK-Nick** · #7 (**permalink**) 02-01-2008, 14:58

Quote:

Originally Posted by cbjroms

Thanks both,

Just to recap the advice is to:

a)Change the port number for MS-SQL - what effect will this have on my website?
b) Windows firewall should also be installed - is this not standard?
c) Disable the remote connections from the SQL server properties - will this impact on my ability to access the database via SSMSSE?

Thanks

Chris

Thats correct. We do not always install the windows firewall as we have come across cases where it has misbehaved & customers have had themselves blocked out. The ticket would be answered shortly.

Regards,
Nick.

**cbjroms** · #8 (**permalink**) 02-01-2008, 15:10

Nick

Changes have been made without any answer to my questions. Now my website is down!!!!

Urgent help now needed.

Chris

**eUK-Nick** · #9 (**permalink**) 02-01-2008, 15:22

Just replied to the ticket.