Skip to Content.
Sympa Menu

freetds - Re: [freetds] How can I connect to MS SQL Server without store us er &password in php file?

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: "Frank M. Kromann" <frank AT kromann.info>
  • To: FreeTDS Development Group <freetds AT lists.ibiblio.org>
  • Cc: 'FreeTDS Development Group' <freetds AT lists.ibiblio.org>
  • Subject: Re: [freetds] How can I connect to MS SQL Server without store us er &password in php file?
  • Date: Thu, 26 Jan 2006 12:21:47 -0800

The simple way of obtaining this is to create a file outside the web
structure

<?php
$strUser = "DOMAIN\\User";
$strPassword = "My Password";
?>

In yoy php script file you will then use include("password.inc"); (or
whatwver the file is called).

You need to specify the path to the directorty where the file is included
from in php.ini.

- Frank

> In response to item #3 (I do quite a bit of php), how is this insecure?
Are
> you concerned that someone will access the source of your script and
view
> the login information? If so, the proper way to go about this is to
find
> why you are concerned about that (escalation of privs through another
> script?) and close that vulnerability. There is no reason to have an
> irrational fear of someone getting your credentials hardcoded in a
script.
> It's just like any other password file. Another idea is to store the
> credentials in a separate password file outside of the webroot, and have
php
> read the file for the information.
>
> -----Original Message-----
> From: Lowden, James K [mailto:LowdenJK AT bernstein.com]
> Sent: Thursday, January 26, 2006 10:05 AM
> To: FreeTDS Development Group
> Subject: Re: [freetds] How can I connect to MS SQL Server without store
user
> &password in php file?
>
> > From: mario.freire AT caixa.gov.br
> > Sent: Thursday, January 26, 2006 6:41 AM
> >
> > Thank you, James K. Lowden!
>
> You're welcome. :-)
>
> > 1) What is "a/k/a trusted connection"?
>
> Sorry. "a/k/a" is an English abbreviation for "also known as". The
> technology has different names. IMO the clearest name is "domain
login".
>
> > 2) So I only need to use the form DOMAIN\username and then the
> > password will be sent encrypted? It is not necessary to do any other
> > configuration or call a special function? Which encrypt protocol will

> > be used?
>
> On a Windows machine, the username (and password?) is cached by the OS.
> When you do:
>
> C:\> isql -E
>
> isql.exe tells the OS to send the cached username and password to the
> server. The password isn't sent in the clear; it's encrypted. How
doesn't
> really matter here, except that it's a well known
challenge-and-response
> protocol. It's also implemented by Samba among others.
>
> With FreeTDS there is no cache to draw on, so you provide the username
and
> password. FreeTDS recognizes the '\' character in the username as an
> indication to emulate 'isql.exe -E' i.e. to perform a domain login.
>
> Across the wire, the server cannot distinguish between isql.exe and
> (say) freebcp.
>
> > 3) Send an encrypted password through the network solves part of the
> > problem. But the password will still be stored in the php file, which

> > is considered insecure... Can I inform the user name and password in a

> > file more protected, not acessible by the browser?
>
> I'm not a PHP or web guru. This is done all the time by people who
know
> how, though. I'm sure you find the answer, if not here then elsewhere.
>
>
> HTH.
>
> --jkl
>
> -----------------------------------------
> The information contained in this transmission may be privileged and
> confidential and is intended only for the use of the person(s) named
above.
> If you are not the intended recipient, or an employee or agent
responsible
> for delivering this message to the intended recipient, any review,
> dissemination, distribution or duplication of this communication is
strictly
> prohibited. If you are not the intended recipient, please contact the
sender
> immediately by reply e-mail and destroy all copies of the original
message.
> Please note that we do not accept account orders and/or instructions by
> e-mail, and therefore will not be responsible for carrying out such
orders
> and/or instructions. If you, as the intended recipient of this message,
the
> purpose of which is to inform and update our clients, prospects and
> consultants of developments relating to our services and products, would
not
> like to receive further e-mail correspondence from the sender, please
> "reply" to the sender indicating your wishes. In the U.S.: 1345 Avenue
of
> the Americas, New York, NY 10105.
> _______________________________________________
> FreeTDS mailing list
> FreeTDS AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/freetds
> _______________________________________________
> FreeTDS mailing list
> FreeTDS AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/freetds
>






  • Re: [freetds] How can I connect to MS SQL Server without store us er &password in php file?, Frank M. Kromann, 01/26/2006

Archive powered by MHonArc 2.6.24.

Top of Page