Skip to Content.
Sympa Menu

freetds - Re: RES: [freetds] Connect to MS SQL Server

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: Steve Langasek <vorlon AT dodds.net>
  • To: freetds AT lists.ibiblio.org
  • Subject: Re: RES: [freetds] Connect to MS SQL Server
  • Date: Thu, 16 Jun 2005 23:08:32 -0700

On Thu, Jun 16, 2005 at 04:35:14PM -0300, Luís Flávio Loreto da Rocha wrote:
> let me explain what I'm need to do. I'm using
> FreeTDS + UnixODBC + mxODBC + Zope.

> The database user and password are saved in zope
> as plain text and the security guys are not happy with that.

Any other means of storing the password will be plaintext-equivalent,
because knowing the "encrypted" form would give you the same access to the
database as the plaintext version. This is particularly true of Windows
domain authentication, where the "encrypted" passwords are hashed via a
known algorithm and can be plugged directly into another client with a
minimum of work in order to get the same access to resources. (But not into
a client that uses FreeTDS, since it's not built to accept such hashes!)

If they don't like this password being available in "plain text", they
should instead be addressing the real issue: i.e., that this
username/password pair is apparently usable for gaining access to more
information than it should.

But perhaps their actual concern is that without using a Windows domain
logon, the password is sent *across the network* as plain text? That can be
addressed just by changing your FreeTDS config to use domain logons, and
whichever account they give you for that purpose.

> If someone have another ideia, I will be very glad.

You could send your security folks off to get an education in security. ;)
Or, you could pick a random algorithm to obfuscate the password on disk, and
deobfuscate it within Zope for passing to mxODBC.

Cheers,
--
Steve Langasek
postmodern programmer

Attachment: signature.asc
Description: Digital signature




Archive powered by MHonArc 2.6.24.

Top of Page