FreeTDS Development Group

[Frediano Ziglio <freddyz77 AT tin.it>]

Il giorno mer, 07/12/2005 alle 21.43 +0100, W.H. van Atteveldt ha
scritto:
> Dear List,
> 
> I want to connect to an MSSQL Server running in a different department.
> I need to connect to this SQL Server from my linux machine to do
> analysis. I have successfully installed freetds and can connect to the
> server in a test setting without any encryption enabled:
> 
> [wva@swpc450 wva]$ /usr/local/freetds/bin/tsql -H <server> -p 1433 -U
> wouter -P <password>
> locale is "en_US.UTF-8"
> locale charset is "UTF-8"
> 1>
> 
>  However, the System Administration of that department requires some
> form of authentication using non-plaintext passwords. I see two general
> options:
> 
> 1) Integrated security:
> 
> The manual states that integrated security (ie domain logon) should be
> supported. However, if I connect using the domain user that the SA
> kindly made for me, I get:
> 
> [wva@swpc450 wva]$ /usr/local/freetds/bin/tsql -H <server> -p 1433 -U
> <domain>\\WH.van.Atteveldt -P <password>
> locale is "en_US.UTF-8"
> locale charset is "UTF-8"
> Msg 18456, Level 14, State 1, Server , Line 0
> Login failed for user '<domain>\WH.van.Atteveldt'.
> Msg 20014, Level 9, State 0, Server OpenClient, Line 0
> Login incorrect.
> There was a problem connecting to the server
> 
> (There is a separate domain controller that I probably need to login
> onto.)
> 
> Is it at all possible to use 'integrated security' using freetds? It
> seems a bit simplistic to just send the domain name and password if the
> server requires a 'trusted connection', which to me sounds like Kerberos
> and all kind of heaby protocols. Not that I know anything about that...
> 

Kerberos is mainly a method to exchange password without exchanging...
password :) Any authentication require some sort of username/password.
We support "integrated security" since 0.60 however we do not support
NTLM2 this means that is server do not accept NTLM you get a login
error. Note that "Login incorrect" means many things. Also we suppose
you are using 0.63 version; what does "tsql -C" say?

> 2) 'Force Protocol Encryption': SSL / TLS
> 
> The new SQL Server SP has a flag that forces connections to be made
> using encryption. If I am correct, this means connecting over an SSL /
> TLS layer.
> 
> a) I have seen some recent messages that support for this has been built
> into freeTDS. Is this correct? How can I enable this?
> 

Yes, implemented months ago using either openssl or gnutls. Some months
ago however means CVS version (0.63 was released on March).
Note that enabling "Force Protocol Encryption" is not sufficient to
enable SSL, you have to add a certificate to mssql... There is a
tsq_ssl.html page on our documentation that explain how to add this
certificate.

> b) Can I use stunnel to connect to the remote sql server? Is there any
> help on getting this to work? If I install stunnel, set
> /usr/local/etc/stunnel/stunnel.conf to cliet=yes and add:
> 
> [sqlserver]
> accept=1434
> connect=fswap02.scw.vu.nl:1433
> 
> And then run stunnel, nothing at all happens, and localhost:1434 times
> out...
> 

In our userguide there is a page for stunnel configuration
(http://www.freetds.org/userguide/stunnel.htm online).

freddy77