DLP Network Discover: 'I/O Error: DB server closed connection' when attempting to scan a SQL Server 2017 instance on Amazon Web Services

Products

• Data Loss Prevention Network Discover

Issue/Introduction

When attempting to scan a SQL Server 2017 instance on Amazon Web Services you observe a failure message in the Enforce Console, and in the discover server's FileReader logs similar to the following:

Oct 28, 2020 3:06:43 PM com.vontu.discover.target.sqldatabase.SQLDatabaseCrawler sendFailureCheckpoint
SEVERE: Unable to create a database connection: Unable to create connection: jdbc:jtds:sqlserver://<hostname>.amazonaws.com:1433, Reason: I/O Error: DB server closed connection..
java.lang.Exception: Unable to create connection: jdbc:jtds:sqlserver://<hostname>.amazonaws.com:1433, Reason: I/O Error: DB server closed connection.
 at com.vontu.discover.target.sqldatabase.SQLDatabaseCrawler.createConnection(SQLDatabaseCrawler.java:541)
 at com.vontu.discover.target.sqldatabase.SQLDatabaseCrawler.extractDatabase(SQLDatabaseCrawler.java:416)
 at com.vontu.discover.target.sqldatabase.SQLDatabaseCrawler.crawl(SQLDatabaseCrawler.java:231)
 at com.vontu.discover.crawler.AbstractCrawler$1.run(AbstractCrawler.java:199)
 at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
 at java.util.concurrent.FutureTask.run(FutureTask.java:266)
 at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
 at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
 at java.lang.Thread.run(Thread.java:748)
Caused by: java.sql.SQLException: I/O Error: DB server closed connection.
 at net.sourceforge.jtds.jdbc.TdsCore.nextToken(TdsCore.java:2307)
 at net.sourceforge.jtds.jdbc.TdsCore.login(TdsCore.java:602)
 at net.sourceforge.jtds.jdbc.ConnectionJDBC2.<init>(ConnectionJDBC2.java:344)
 at net.sourceforge.jtds.jdbc.ConnectionJDBC3.<init>(ConnectionJDBC3.java:50)
 at net.sourceforge.jtds.jdbc.Driver.connect(Driver.java:182)
 at com.vontu.discover.target.sqldatabase.SQLDatabaseCrawler.createConnection(SQLDatabaseCrawler.java:536)
 ... 8 more
Caused by: java.io.IOException: DB server closed connection.
 at net.sourceforge.jtds.jdbc.SharedSocket.readPacket(SharedSocket.java:843)
 at net.sourceforge.jtds.jdbc.SharedSocket.getNetPacket(SharedSocket.java:722)
 at net.sourceforge.jtds.jdbc.ResponseStream.getPacket(ResponseStream.java:466)
 at net.sourceforge.jtds.jdbc.ResponseStream.read(ResponseStream.java:103)
 at net.sourceforge.jtds.jdbc.TdsCore.nextToken(TdsCore.java:2202)
 ... 13 more
Oct 28, 2020 3:06:43 PM com.vontu.discover.target.sqldatabase.SQLDatabaseCrawler crawl

Environment

DLP Network Discover 15.7

Cause

This appears to be caused by an incompatibility between the jtds driver v1.2.2 and SQL Server 2017.

 

Resolution

1. On the discover server that is running the scan:
   1. Download and install the Microsoft JDBC driver jar version mssql-jdbc-8.4.1.jre8.jar or later into the C:\Program Files\Symantec\DataLossPrevention\DetectionServer\<ver>\Protect\lib\jdbc directory.
   2. Edit the sqldatabasecrawler.properties file, in the Microsoft SQL Server section and switch the following properties from the default of jtds to utilize the new MS JDBC driver, as shown below:

      driver_class.sqlserver = com.microsoft.sqlserver.jdbc.SQLServerDriver
      driver_jar.sqlserver = mssql-jdbc-8.4.1.jre8.jar
      driver_subprotocol.sqlserver = sqlserver