FreeTDS Development Group

["Pickett, David" <David.Pickett AT phlx.com>]

Using a SSH/SSL tunnel from client to server is a simple way to take the
plaintext password off the net without touching the client (except to
configure the db as being on a local tunnel port) or the server (except to
install a tunnel service from the SSH incoming port to the local db server
port).  There are many tunneling products out there, many free.  I have uses
SSH2 and Putty to secure VNC this way.

Another roundabout way to the same end is to make your application a light
https:// service on the DB server host, or a host securely connected to the
DB server host.

Best regards,

David

-----Original Message-----
From: W.H. van Atteveldt [mailto:wouter AT 2at.nl]
Sent: Wednesday, December 07, 2005 3:43 PM
To: freetds AT lists.ibiblio.org
Subject: [freetds] 'secure connection' to SQL server. Integrated
security, ssl?


Dear List,

I want to connect to an MSSQL Server running in a different department.
I need to connect to this SQL Server from my linux machine to do
analysis. I have successfully installed freetds and can connect to the
server in a test setting without any encryption enabled:

[wva@swpc450 wva]$ /usr/local/freetds/bin/tsql -H <server> -p 1433 -U
wouter -P <password>
locale is "en_US.UTF-8"
locale charset is "UTF-8"
1>

 However, the System Administration of that department requires some
form of authentication using non-plaintext passwords. I see two general
options:

1) Integrated security:

The manual states that integrated security (ie domain logon) should be
supported. However, if I connect using the domain user that the SA
kindly made for me, I get:

[wva@swpc450 wva]$ /usr/local/freetds/bin/tsql -H <server> -p 1433 -U
<domain>\\WH.van.Atteveldt -P <password>
locale is "en_US.UTF-8"
locale charset is "UTF-8"
Msg 18456, Level 14, State 1, Server , Line 0
Login failed for user '<domain>\WH.van.Atteveldt'.
Msg 20014, Level 9, State 0, Server OpenClient, Line 0
Login incorrect.
There was a problem connecting to the server

(There is a separate domain controller that I probably need to login
onto.)

Is it at all possible to use 'integrated security' using freetds? It
seems a bit simplistic to just send the domain name and password if the
server requires a 'trusted connection', which to me sounds like Kerberos
and all kind of heaby protocols. Not that I know anything about that...

2) 'Force Protocol Encryption': SSL / TLS

The new SQL Server SP has a flag that forces connections to be made
using encryption. If I am correct, this means connecting over an SSL /
TLS layer.

a) I have seen some recent messages that support for this has been built
into freeTDS. Is this correct? How can I enable this?

b) Can I use stunnel to connect to the remote sql server? Is there any
help on getting this to work? If I install stunnel, set
/usr/local/etc/stunnel/stunnel.conf to cliet=yes and add:

[sqlserver]
accept=1434
connect=fswap02.scw.vu.nl:1433

And then run stunnel, nothing at all happens, and localhost:1434 times
out...

Any help greatly appreciated!

Wouter


_______________________________________________
FreeTDS mailing list
FreeTDS AT lists.ibiblio.org
http://lists.ibiblio.org/mailman/listinfo/freetds