Report this

What is the reason for this report?

Is my mssql 2017 being targeted? Am I being attacked?

Posted on October 8, 2019

My mssql 2017 shows in errorlog ‘Password did not match that for the login provided. [CLIENT: 177.159.243.118]’ The ip could be 61.175.211.164 from China or others from Brazil, Iran… This is running continuously. My apps work fine. Am I being attacked?



This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Hello,

Most likely a bot is trying to brute-force your SQL password.

I would strongly recommend closing the SQL port via your droplet’s firewall so that no one could reach your SQL server externally. If you ever need to access the SQL instance remotely, you could whitelist only your own IP.

Regards, Bobby

Sooo…I changed the sa login and implemented a stronger password. Now they have to guess the user name.

The developer cloud

Scale up as you grow — whether you're running one virtual machine or ten thousand.

Get started for free

Sign up and get $200 in credit for your first 60 days with DigitalOcean.*

*This promotional offer applies to new accounts only.