{"id":1633,"date":"2026-01-02T20:55:30","date_gmt":"2026-01-02T20:55:30","guid":{"rendered":"https:\/\/b2bhostingclub.com\/blog\/?p=1633"},"modified":"2026-02-04T14:14:36","modified_gmt":"2026-02-04T14:14:36","slug":"how-to-prevent-brute-force-login-attacks-on-mssql","status":"publish","type":"post","link":"https:\/\/b2bhostingclub.com\/blog\/how-to-prevent-brute-force-login-attacks-on-mssql\/","title":{"rendered":"How to Prevent Brute-force Login Attacks on MSSQL"},"content":{"rendered":"
\n
\n
\n

Introduction<\/h2>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n
\n
\n
\n

If you are running Microsoft SQL Server, you may be aware that your SA account is subject to a brute force attack. Nearly every SQL server connected to the Internet is under constant attack. Once a hacker is able to gain access to a SA (DBA) account, or even a normal user account, it can gain full access to the file system on the server and even the files on the network it is connected to.<\/p>\n<\/div>\n<\/div>\n

\n
\n

By detecting logins that fail and block their IP address for some time, you will most likely have them move on to attack another server instead. We can create firewall rules that stop the attackers after a few attempts.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n
\n
\n

3 Steps to Prevent Brute-force Attacks on MSSQL on Windows<\/h2>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n

Step 1. Open Login Auditing<\/h3>\n
\n
\n
\n

fiber_manual_record<\/span>\u00a0Enable auditing of service login authentication so that the SQL log will record relevant login information.<\/p>\n<\/div>\n<\/div>\n

\n
\n
\"MSSQL<\/div>\n<\/div>\n<\/div>\n
\n
\n
\"MSSQL<\/div>\n<\/div>\n<\/div>\n
\n
\n

fiber_manual_record<\/span>\u00a0Configure Log files size and count<\/p>\n<\/div>\n<\/div>\n

\n
\n
\"SQL<\/div>\n<\/div>\n<\/div>\n
\n
\n
\"Configure<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n

Step 2. Analyze log files<\/h3>\n
\n
\n
\n

Microsoft SQL Server logs failed login attempts in SQL Server Logs, which practically is the ERRORLOG file in your SQL Server Log directory. An failed login attempt is for example:<\/p>\n<\/div>\n<\/div>\n

\n
\n
2021-09-16 00:21:04.95 Logon       Error: 18456, Severity: 14, State: 8.\r\n2021-09-16 00:21:04.95 Logon       Login failed for user 'sa'. Reason: Password did not match that for the login provided. [CLIENT: 213.252.0.12]<\/pre>\n<\/div>\n<\/div>\n
\n
\n
\"Analyze<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n
Step 3. Add abnormal IP to firewall<\/h3>\n
\n
\n
\n
Add the analyzed dangerous IP source addresses, such as 1.1.1.1 and 1.1.1.2, to the local firewall.<\/p>\n<\/div>\n<\/div>\n
\n
\n
\"Add<\/div>\n<\/div>\n<\/div>\n
\n
\n
In order to protect your SQL Server from these brute force attacks, you need to block this IP address. \u201cOK, that\u2019s easy\u201d, you might think. But what if there are thousands of log lines? Let\u2019s use PowerShell to automate parsing this log and filtering IP\u2019s to block.<\/p>\n<\/div>\n<\/div>\n
\n
\n
In a nutshell, you\u2019re going to use PowerShell to:<\/p>\n<\/div>\n<\/div>\n
\n
\n
fiber_manual_record<\/span>\u00a0parse SQL Server ERRORLOG log file
\nfiber_manual_record<\/span>\u00a0get all IP addresses responsible for failed login attempts
\nfiber_manual_record<\/span>\u00a0filter out your own IP addresses (you don\u2019t want to lock yourself out)
\nfiber_manual_record<\/span>\u00a0add those IP\u2019s to the Windows Defender Firewall with Advanced Security. If it\u2019s not listed yet, that is.<\/p>\n<\/div>\n<\/div>\n
\n
\n
Note: We will develop a small tool for our customers to use, please pay attention to updates here.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n
How to Prevent Brute Force Login Attacks on SQL Server on Linux<\/h2>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n
\n
\n
\n
The method to prevent brute force login attacks on SQL Server on Linux systems is similar to that on Windows. Moreover, Linux is more convenient because there is a powerful and free fail2ban tool available.<\/p>\n<\/div>\n<\/div>\n
\n
\n
There is a script on Github\uff08https:\/\/github.com\/ToulisDev\/fail2ban-action-mssql<\/a>\uff09 to add banned ips from fail2ban to your MS SQL server using ban-action from fail2ban. (Tested on Ubuntu Server)<\/p>\n<\/div>\n<\/div>\n
\n
\n
For more information about the use of Fail2ban, you can visit\u00a0How to Prevent SSH Brute-Force Attacks on Linux Using Fail2ban<\/a>.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
Introduction If you are running Microsoft SQL Server, you may be aware that your SA account is subject to a brute force attack. Nearly every SQL server connected to the Internet is under constant attack. Once a hacker is able to gain access to a SA (DBA) account, or even a normal user account, it […]<\/p>\n","protected":false},"author":4,"featured_media":1634,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1633","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux-hosting"],"_links":{"self":[{"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/posts\/1633","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/comments?post=1633"}],"version-history":[{"count":1,"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/posts\/1633\/revisions"}],"predecessor-version":[{"id":1635,"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/posts\/1633\/revisions\/1635"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/media\/1634"}],"wp:attachment":[{"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/media?parent=1633"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/categories?post=1633"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/tags?post=1633"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}