[freetds] SQL Server 2005 and TDS version 8 -- is login always encapsulated in TLS (encrypted)?
Bob Hetzel
beh at case.edu
Mon Sep 24 17:54:36 EDT 2007
1) SQL 2005 does not by default require encryption on data traffic. I
think I read somewhere that all logins are encrypted, however.
2) Windows Integrated Authentication does not have to use kerberos.
Windows understands a variety of flavors of authentication that use
varying "qualities" of encryption. Some encyptions that are used by
default on windows XP can be cracked in seconds using a brute force
trial and error decryption attack on 5 yr old computers (i.e. no high
end computing hardware needed at all). To use kerberos you probably
have to enable a property named "delegation" and you have to have it
running in an active directory setup. This probably isn't the place to
look for info on that though. If you google it you'll find lots of good
info I expect.
Encrypting the login is only half the battle. If you want to ensure
that sensitive info isn't available to people not entitled to it you
should probably
a) use firewalls so nobody but your intended users can even connect to
the SQL server, and
b) encrypt all the traffic--not just the login.
Bob
crawford charles wrote:
> Freddy's response to Adam's question prompts me to
> ask one of my own:
> Do version 8 MS SQL clients *always* use TLS to
> encapsulate the LOGIN, or can other encapsulations
> be used to hide the login ID?
> I read the MSSQL document (thank you), and what I
> believe to be the relevant parts of freeTDS code, but
> that tells me one way to get the client and server
> talking over a TCP session.
> I know that "Windows Integrated Authentication" uses
> Kerberos. Is there a way for a SqlServer 2005 client
> to use these Kerberos-derived credentials (and
> possibly
> the Kerberos session key) for the SqlServer login?
>
> Thanks.
>
> --- "ZIGLIO, Frediano, VF-IT"
> <Frediano.Ziglio at vodafone.com> wrote:
>
>>> Hi all,
>>> I have been using some perl scripts with SQL
>> 2000 for a
>>> while now and
>>> our organisation is looking to use 2005 in the
>> near future.
>>> The only way I can get a connection to SQL 2005 is
>> to lower my TDS
>>> version to 7.0.
>>>
> <snip>
>>> Message String: Login incorrect.
>>>
>>> Any ideas?
>>>
>>> Cheers
>>>
>>>
>>> Adam Clark
>>> Network Administrator
>>>
>> Which FreeTDS version are you using?
>> Are you using domain authentication?
>> If you are using 0.64 did you apply patch at
>> http://freetds.sourceforge.net/?
>>
>> freddy77
>
>
>
> ____________________________________________________________________________________
> Take the Internet to Go: Yahoo!Go puts the Internet in your pocket: mail, news, photos & more.
> http://mobile.yahoo.com/go?refer=1GNXIC
> _______________________________________________
> FreeTDS mailing list
> FreeTDS at lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/freetds
More information about the FreeTDS
mailing list