Skip to Content.
Sympa Menu

freetds - Re: [freetds] SQL Server 2005 and TDS version 8 -- is login always encapsulated in TLS (encrypted)?

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: Bob Hetzel <beh AT case.edu>
  • To: FreeTDS Development Group <freetds AT lists.ibiblio.org>
  • Subject: Re: [freetds] SQL Server 2005 and TDS version 8 -- is login always encapsulated in TLS (encrypted)?
  • Date: Mon, 24 Sep 2007 17:54:36 -0400

1) SQL 2005 does not by default require encryption on data traffic. I think I read somewhere that all logins are encrypted, however.

2) Windows Integrated Authentication does not have to use kerberos. Windows understands a variety of flavors of authentication that use varying "qualities" of encryption. Some encyptions that are used by default on windows XP can be cracked in seconds using a brute force trial and error decryption attack on 5 yr old computers (i.e. no high end computing hardware needed at all). To use kerberos you probably have to enable a property named "delegation" and you have to have it running in an active directory setup. This probably isn't the place to look for info on that though. If you google it you'll find lots of good info I expect.

Encrypting the login is only half the battle. If you want to ensure that sensitive info isn't available to people not entitled to it you should probably

a) use firewalls so nobody but your intended users can even connect to the SQL server, and

b) encrypt all the traffic--not just the login.

Bob

crawford charles wrote:
Freddy's response to Adam's question prompts me to
ask one of my own:
Do version 8 MS SQL clients *always* use TLS to
encapsulate the LOGIN, or can other encapsulations
be used to hide the login ID?
I read the MSSQL document (thank you), and what I
believe to be the relevant parts of freeTDS code, but
that tells me one way to get the client and server
talking over a TCP session.
I know that "Windows Integrated Authentication" uses
Kerberos. Is there a way for a SqlServer 2005 client
to use these Kerberos-derived credentials (and
possibly
the Kerberos session key) for the SqlServer login?

Thanks.

--- "ZIGLIO, Frediano, VF-IT"
<Frediano.Ziglio AT vodafone.com> wrote:

Hi all,
I have been using some perl scripts with SQL
2000 for a
while now and
our organisation is looking to use 2005 in the
near future.
The only way I can get a connection to SQL 2005 is
to lower my TDS
version to 7.0.

<snip>
Message String: Login incorrect.

Any ideas?

Cheers


Adam Clark
Network Administrator

Which FreeTDS version are you using?
Are you using domain authentication?
If you are using 0.64 did you apply patch at
http://freetds.sourceforge.net/?

freddy77


____________________________________________________________________________________
Take the Internet to Go: Yahoo!Go puts the Internet in your pocket: mail, news, photos & more. http://mobile.yahoo.com/go?refer=1GNXIC
_______________________________________________
FreeTDS mailing list
FreeTDS AT lists.ibiblio.org
http://lists.ibiblio.org/mailman/listinfo/freetds




Archive powered by MHonArc 2.6.24.

Top of Page