Skip to Content.
Sympa Menu

freetds - Re: [freetds] Backporting NTLMv2 (was: NTLMv2 support for domain logins using freetds)

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: Frediano Ziglio <freddy77 AT gmail.com>
  • To: FreeTDS Development Group <freetds AT lists.ibiblio.org>
  • Subject: Re: [freetds] Backporting NTLMv2 (was: NTLMv2 support for domain logins using freetds)
  • Date: Fri, 01 Aug 2008 18:28:16 +0200

Il giorno gio, 31/07/2008 alle 18.25 -0400, Sergey Sikorskiy ha scritto:
> Hi,
>
> I've just checked with Microsoft web-site and found detailed
> documentation for NTLM.
>
> http://msdn.microsoft.com/en-us/library/cc207842.aspx
>
> This documentation clearly says that "(1.7) "The NTLM authentication
> version is not negotiated by the protocol. It must be configured on
> both the client and the server prior to authentication. The version is
> selected by the client, and requested during the protocol negotiation.
> If the server does not support the version selected by the client,
> authentication fails."
>
> The rest is negotiable, including sending of LMv2 hash, which won't be
> sent in my implementation.
>

yes, but I think that client should say: I support all these and server
reply, you can use such... If we support all versions we should be
always able to negotiate the correct (most secure) authentication.
I think that is NTLM2 is negotiated either NTLMv2 or NTLM2 should be
used. At this point I think that if we have valid Target Info NTLMv2
should be negotiated...

> After looking over documentation I figured out that negotiation part
> is almost completely missing in my implementation. I'm sorry, but this
> documentation wasn't available two years ago.
>

Mmmm... not that hard to implement...

freddy77






Archive powered by MHonArc 2.6.24.

Top of Page