RES: [freetds] Connect to MS SQL Server
ZIGLIO, Frediano, VF-IT
Frediano.Ziglio at vodafone.com
Fri Jun 17 02:21:30 EDT 2005
> On Thu, Jun 16, 2005 at 04:35:14PM -0300, Luís Flávio Loreto
> da Rocha wrote:
> > let me explain what I'm need to do. I'm using
> > FreeTDS + UnixODBC + mxODBC + Zope.
> > The database user and password are saved in zope
> > as plain text and the security guys are not happy with that.
> Any other means of storing the password will be plaintext-equivalent,
> because knowing the "encrypted" form would give you the same
> access to the
> database as the plaintext version. This is particularly true
> of Windows
> domain authentication, where the "encrypted" passwords are
> hashed via a
> known algorithm and can be plugged directly into another client with a
> minimum of work in order to get the same access to resources.
> (But not into
> a client that uses FreeTDS, since it's not built to accept
> such hashes!)
> If they don't like this password being available in "plain text", they
> should instead be addressing the real issue: i.e., that this
> username/password pair is apparently usable for gaining access to more
> information than it should.
> But perhaps their actual concern is that without using a
> Windows domain
> logon, the password is sent *across the network* as plain
> text? That can be
> addressed just by changing your FreeTDS config to use domain
> logons, and
> whichever account they give you for that purpose.
> > If someone have another ideia, I will be very glad.
> You could send your security folks off to get an education in
> security. ;)
> Or, you could pick a random algorithm to obfuscate the
> password on disk, and
> deobfuscate it within Zope for passing to mxODBC.
Or use SSL... but this is 0.64, not 0.64...
More information about the FreeTDS