SQL servers - no longer open to outside on new and old will be set this way soon

Customer Support Customer Only Discussion
1

Just as an update on official policy.

No outside server Access to SQL servers is available via direct means anymore.

this is due to the vast amount of botnets and other attacks on the SQL servers that impact customers in a very negative manner.

We initially start this and have been whitelisting on the firewall people that need access, however we realize this is a lot of work for both clients, and our admins, and many people have dynamic IPs so whitelisting is needing to change all the time.

To that end, we’ve got a setup on alternative ports on a special server that will give you access to the SQL server remote for management purposes.

on SQL Management studio you need to put in the IP address with a , then the port number.

All SQL Servers will be on the same IP address externally now, and only the port will differ.

For the time being the list goes like this:

CL1:
MSSQL1 173.0.136.201,5201
MSSQL4 173.0.136.201,5204
MSSQL8 173.0.136.201,5208
MSSQL10 173.0.136.201.5210
MSSQL12 173.0.136.201,5212
MSSQL11 173.0.136.201,5211
MSSQL13 173.0.136.201,5213

CL2:

mssql1 mssqlmgr.go hsphere.com 5001
mssql2 mssqlmgr.go hsphere.com 5002
mssql3 mssqlmgr.go hsphere.com 5003
mssql4 mssqlmgr.go hsphere.com 5004

(remove spaces in go hsphere.com), put a comma after the name,PORT

VPS:
VZSQL1 use 173.0.136.201,5101 to access

Others will be added here as they are added to the network behind the firewall.

2

Re: MSSQL servers - no longer open to outside on new and old will be set this way soo

I just want to point out, we aren’t doing this to make it harder for clients to login and manage their SQL DBs, as some have accused, we are doing it simply for security and reliability reasons.

We have to block 100s of IPs a week, sometimes thousands, just to stop attacks, and the time spent blocking if becoming larger and larger. At the same time, they can go unblocked at times, and make the server performance degrade greatly, preventing logins of legit queries from happening and other things such as this.

3

Re: MSSQL servers - no longer open to outside on new and old will be set this way soo

updated adding VZSQL1.

4

Re: MSSQL servers - no longer open to outside on new and old will be set this way soo

I’m deleting my comment because this thread might not apply to me…sorry, you can return to your regularly scheduled programs now. :slight_smile:

5

Re: MSSQL servers - no longer open to outside on new and old will be set this way soo

:smiley:

You can ask questions if you wish :slight_smile:

6

Re: MSSQL servers - no longer open to outside on new and old will be set this way soo

So I had missed the “MSSQL” in the thread title. I don’t have any MS SQL servers, but I do use plenty of MySQL resources. And I do very much appreciate remote access to the DBs (so I can use HeidiSQL and other tools). Are you going to place the same block on the MySQL servers?

7

Re: MSSQL servers - no longer open to outside on new and old will be set this way soo

Quite likely, but we will put workarounds for them on alternative ports too :slight_smile:

We aren’t trying to lock out legit use, just abusive botnets and some remote servers that people think they can use 100mb/s on because they have a sql db.

8

Re: MSSQL servers - no longer open to outside on new and old will be set this way soo

I support this. While it’s very convenient to have direct access to the SQL server, it’s not exactly the most secure way of running a web site. If I told my clients their SQL server is open to the net, as they’d probably have a fit. :slight_smile:

Most shared hosts do it, so I’m very happy you guys are actively seeking a better way.
VPN would be good.. but let me guess, HSphere doesn’t support it. :slight_smile:

9

Re: MSSQL servers - no longer open to outside on new and old will be set this way soo

CL2:
Server – MSSQL hostname ------port

mssql1 mssqlmgr.go hsphere.com 5001
mssql2 mssqlmgr.go hsphere.com 5002
mssql3 mssqlmgr.go hsphere.com 5003
mssql4 mssqlmgr.go hsphere.com 5004

*please remove spaces from hostname before use.

10

Re: MSSQL servers - no longer open to outside on new and old will be set this way soo

Is it possible to attach a domain name to the IP address, just to make it easier to remember? Perhaps mssql.jodohost.com? Then if the IPs ever need to change, we won’t have to change things at our end.

11

Re: MSSQL servers - no longer open to outside on new and old will be set this way soo

Good suggestion and done :slight_smile:

12

Re: MSSQL servers - no longer open to outside on new and old will be set this way soo

Hmm, I tried “mssqlmgr.g********.com”, port 5002, to connect to MSSQL2 but it’s not finding the sql server. Works ok using the IP address.

13

Re: MSSQL servers - no longer open to outside on new and old will be set this way soo

Slave NS didn’t have the record yet. Try ipconfig/flushdns and then ping to see if it resolves correct.

14

Re: MSSQL servers - no longer open to outside on new and old will be set this way soo

Ah no worries, I’ll try again later on.

15

Re: MSSQL servers - no longer open to outside on new and old will be set this way soo

Just wondering, does “mssqlmgr.g********.com” translate to a reseller’s branded domain? For example “mssqlmgr.myservicedomain.com”?

16

Re: MSSQL servers - no longer open to outside on new and old will be set this way soo

Resellers can make simple CNAME to this.

17

Re: MSSQL servers - no longer open to outside on new and old will be set this way soo

Does it also affects DB backup option?
now backup option
http://mssql1.g********.com/mssql/Backup.aspx and
http://mssql3.g********.com/mssql/Backup.aspx
are down.

http://mssql4.g********.com/mssql/Backup.aspx is working but have java script error so form is not getting submitted, i had created ticket for this ([JH #KLN-18155-236]) but not resolved yet.

18

Re: MSSQL servers - no longer open to outside on new and old will be set this way soo

Hello,

DB Backup is not yet in place will be by week end.

19

Re: MSSQL servers - no longer open to outside on new and old will be set this way soo

This is both to provide a bump and to just mention, DO NOT use these in your web.config for web servers, it makes the connections to the remote services we are providing here clog up, and gives you a failure point when that happens.

20

Re: MSSQL servers - no longer open to outside on new and old will be set this way soo

It would be great if there was a central place of reference for these things. Otherwise it relies on us to keep bookmarks of forum posts, and makes more work for support with people asking the same questions. Maybe a wiki is overkill, but just a couple of pages of this sort of info?

  1. Old & New IP addresses (eventually replaced with just the new IP addresses, perhaps just for name servers)
  2. These IP addresses & ports for external db server access.
  3. Internal port to use for SMTP (587 I think?)

I’m sure there’s lots of other stuff.