每秒进行一次 SQL 故障审核
我正在查看计算机上的事件查看器，发现应用程序事件查看器中的每个事件都是 SQL Server 的故障审核。事件的属性都说了
用户“sa”登录失败。原因： 密码与密码不匹配 提供登录。 [客户： 78.111.98.132]
这是否意味着有人试图破解我的密码？有办法阻止这一切吗？而且除了这件事之外似乎没有其他事件，这有什么原因吗？
这是 Windows Server 2003 R2 企业版，带有 Service Pack 2 运行 SQL Server Standard 2008
I'm looking at my event viewer on my computer and seeing that every single event in the Applicaiton event viewer is a Failure Audit for SQL Server. The properties of the event all say
Login failed for user 'sa'. Reason:
Password did not match that for the
login provided. [CLIENT:
78.111.98.132]
Does this mean that there is somebody trying to crack my password? IS there anyway to stop this? Also there don't seem to be any other events beside this one, is there a reason for that?
This is a Windows Server 2003 R2 Enterprise edition, w/ Service Pack 2
running SQL Server Standard 2008
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您提供的 IP 地址追踪到伊斯坦布尔的一家土耳其 ISP，我怀疑这不是您期望登录尝试的地方，当然也不是 SA。
除非您绝对需要，否则请禁用 SA 帐户、禁止 IP 范围，然后获取有关服务器强化的更多信息。
The IP you gave traces to a Turkish ISP in Istanbul, and I suspect that is not where you expecting login attempts, certainly not to SA.
Unless you absolutely need it, disable the SA account, ban the IP range and then get more info on server hardening.
任何暴露在互联网上的 SQL Server 每小时都会收到数百个此类事件。有许多机器人不断扫描默认SQL服务器端口上的弱sa密码。移动 SQL Server 侦听端口将增加一些非常小的价值，搜索任何开放端口的扫描次数一样多。虽然您可以将可疑 IP 列入黑名单，但攻击者通常拥有大量 IP 可供使用，因此这是一场失败的战斗。
真正的解决方案是完全从互联网上撤回 SQL Server。您有什么具体原因来监听网络吗？您不必更改物理位置，只需将 SQL Server 端点配置为仅侦听本地和 Intranet 地址。
Any SQL Server exposed to the internet will get hundreds of such events per hour. There are many bots scanning constantly for weak sa passwords on the default SQL server port. Moving the SQL Server listenning port will add some very marginal value, there are just as many scans searching for any open port. While you can blacklist suspicious IPs, attackers usualy have herds and herds of IPs to use, so is a loosing battle.
The real solution is to withdraw your SQL Server from the internet altogether. Do you have any specific reason why its listenning to the net? You don't have to change the physical location, just configure the SQL Server endpoints to listen only on the local and intranet addresses.