MS SQL Server Brute-Force Protection

• Protection overview
• Enable SQL Server login auditing
• Configure MS SQL Server protection

RdpGuard protects Microsoft SQL Server from password-guessing attacks by monitoring the Windows Application log. It blocks an IP address when the number of detected failed login or scan attempts reaches the configured limit.

Run RdpGuard on the Windows computer hosting SQL Server. Enable SQL Server login auditing, then choose which events RdpGuard should monitor: 18456, 17832 and 17836.

1. Open SQL Server Management Studio and connect to your SQL Server instance.

2. In Object Explorer, right-click the server and select Properties.

   

3. Select Security. Under Login auditing, choose Failed logins only or Both failed and successful logins.

   

4. Click OK, then restart the SQL Server instance to apply the changed audit setting.

   Choose a suitable time: restarting SQL Server disconnects active database sessions.

For more details, see Microsoft's login auditing instructions.

1. Open RdpGuard Dashboard and click MS-SQL under Monitored protocols.

   

2. Select Enable MS-SQL protection, choose the events to monitor and click Save.

   

Events to monitor

All three events are enabled by default:

• 18456 - Failed login. Keep this enabled to detect repeated login failures. A failed login can also come from a mistyped password or a misconfigured application.
• 17832 - Invalid login packet. SQL Server could not process the client's login packet. This can indicate a probe, but can also result from client or server configuration problems.
• 17836 - Packet length mismatch. The packet's declared length does not match the data received. RdpGuard counts these events as scan attempts.

Exclusions for Event ID 18456

Use exclusions to ignore known, legitimate failures recorded as event 18456. Copy a distinctive text fragment from the event's Reason field.

1. In MS-SQL Settings, click Exclusions... next to Event ID 18456.

   

2. Enter one text pattern per line, then click OK.

   

3. Click Save in MS-SQL Settings to apply the exclusions.

Matching is case-sensitive. Patterns are literal text; * and ? are not wildcards. An event is skipped if any pattern occurs within one of its event-data values.

Patterns can also match fields other than Reason, so avoid short or generic text. These exclusions apply only to event 18456, not to 17832 or 17836.