Skip to Content.
Sympa Menu

freetds - RE: RES: [freetds] Connect to MS SQL Server

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: "ZIGLIO, Frediano, VF-IT" <Frediano.Ziglio AT vodafone.com>
  • To: "FreeTDS Development Group" <freetds AT lists.ibiblio.org>
  • Subject: RE: RES: [freetds] Connect to MS SQL Server
  • Date: Fri, 17 Jun 2005 08:21:30 +0200

>
> On Thu, Jun 16, 2005 at 04:35:14PM -0300, Luís Flávio Loreto
> da Rocha wrote:
> > let me explain what I'm need to do. I'm using
> > FreeTDS + UnixODBC + mxODBC + Zope.
>
> > The database user and password are saved in zope
> > as plain text and the security guys are not happy with that.
>
> Any other means of storing the password will be plaintext-equivalent,
> because knowing the "encrypted" form would give you the same
> access to the
> database as the plaintext version. This is particularly true
> of Windows
> domain authentication, where the "encrypted" passwords are
> hashed via a
> known algorithm and can be plugged directly into another client with a
> minimum of work in order to get the same access to resources.
> (But not into
> a client that uses FreeTDS, since it's not built to accept
> such hashes!)
>
> If they don't like this password being available in "plain text", they
> should instead be addressing the real issue: i.e., that this
> username/password pair is apparently usable for gaining access to more
> information than it should.
>
> But perhaps their actual concern is that without using a
> Windows domain
> logon, the password is sent *across the network* as plain
> text? That can be
> addressed just by changing your FreeTDS config to use domain
> logons, and
> whichever account they give you for that purpose.
>
> > If someone have another ideia, I will be very glad.
>
> You could send your security folks off to get an education in
> security. ;)
> Or, you could pick a random algorithm to obfuscate the
> password on disk, and
> deobfuscate it within Zope for passing to mxODBC.
>

Or use SSL... but this is 0.64, not 0.64...

freddy77




Archive powered by MHonArc 2.6.24.

Top of Page