RES: [freetds] Connect to MS SQL Server

ZIGLIO, Frediano, VF-IT Frediano.Ziglio at vodafone.com
Fri Jun 17 02:21:30 EDT 2005


> 
> On Thu, Jun 16, 2005 at 04:35:14PM -0300, Luís Flávio Loreto 
> da Rocha wrote:
> > let me explain what I'm need to do. I'm using 
> > FreeTDS + UnixODBC + mxODBC + Zope.
> 
> > The database user and password are saved in zope 
> > as plain text and the security guys are not happy with that.
> 
> Any other means of storing the password will be plaintext-equivalent,
> because knowing the "encrypted" form would give you the same 
> access to the
> database as the plaintext version.  This is particularly true 
> of Windows
> domain authentication, where the "encrypted" passwords are 
> hashed via a
> known algorithm and can be plugged directly into another client with a
> minimum of work in order to get the same access to resources. 
>  (But not into
> a client that uses FreeTDS, since it's not built to accept 
> such hashes!)
> 
> If they don't like this password being available in "plain text", they
> should instead be addressing the real issue: i.e., that this
> username/password pair is apparently usable for gaining access to more
> information than it should.
> 
> But perhaps their actual concern is that without using a 
> Windows domain
> logon, the password is sent *across the network* as plain 
> text?  That can be
> addressed just by changing your FreeTDS config to use domain 
> logons, and
> whichever account they give you for that purpose.
> 
> > If someone have another ideia, I will be very glad.
> 
> You could send your security folks off to get an education in 
> security. ;)
> Or, you could pick a random algorithm to obfuscate the 
> password on disk, and
> deobfuscate it within Zope for passing to mxODBC.
> 

Or use SSL... but this is 0.64, not 0.64...

freddy77



More information about the FreeTDS mailing list