FreeTDS Development Group

["W.H. van Atteveldt" <wouter AT 2at.nl>]

Dear David, James,

Thank you for your quick answers. However, I do not have control over
the server machine, and I think (from the failes
<domain>\wh.van.atteveldt test, that the machine does not accept domain
logon over tcp. I could try to persuade the syadmin to allow that, but I
would be much happier if that would not be necessary. So I suppose the
question really is:

Can I use a linux freetds client to connect to a mssql server that has
the 'force protocol encryption' box checked?

Thanks,

Wouter

> -----Original Message-----
> From: freetds-bounces AT lists.ibiblio.org [mailto:freetds-
> bounces AT lists.ibiblio.org] On Behalf Of Pickett, David
> Sent: 08 December 2005 16:57
> To: 'FreeTDS Development Group'
> Subject: Re: [freetds] 'secure connection' to SQL server.
Integratedsecur
> ity, ssl?
> 
> Using a SSH/SSL tunnel from client to server is a simple way to take
the
> plaintext password off the net without touching the client (except to
> configure the db as being on a local tunnel port) or the server
(except to
> install a tunnel service from the SSH incoming port to the local db
server
> port).  There are many tunneling products out there, many free.  I
have
> uses
> SSH2 and Putty to secure VNC this way.
> 
> Another roundabout way to the same end is to make your application a
light
> https:// service on the DB server host, or a host securely connected
to
> the
> DB server host.
> 
> Best regards,
> 
> David
> 
> -----Original Message-----
> From: W.H. van Atteveldt [mailto:wouter AT 2at.nl]
> Sent: Wednesday, December 07, 2005 3:43 PM
> To: freetds AT lists.ibiblio.org
> Subject: [freetds] 'secure connection' to SQL server. Integrated
> security, ssl?
> 
> 
> Dear List,
> 
> I want to connect to an MSSQL Server running in a different
department.
> I need to connect to this SQL Server from my linux machine to do
> analysis. I have successfully installed freetds and can connect to the
> server in a test setting without any encryption enabled:
> 
> [wva@swpc450 wva]$ /usr/local/freetds/bin/tsql -H <server> -p 1433 -U
> wouter -P <password>
> locale is "en_US.UTF-8"
> locale charset is "UTF-8"
> 1>
> 
>  However, the System Administration of that department requires some
> form of authentication using non-plaintext passwords. I see two
general
> options:
> 
> 1) Integrated security:
> 
> The manual states that integrated security (ie domain logon) should be
> supported. However, if I connect using the domain user that the SA
> kindly made for me, I get:
> 
> [wva@swpc450 wva]$ /usr/local/freetds/bin/tsql -H <server> -p 1433 -U
> <domain>\\WH.van.Atteveldt -P <password>
> locale is "en_US.UTF-8"
> locale charset is "UTF-8"
> Msg 18456, Level 14, State 1, Server , Line 0
> Login failed for user '<domain>\WH.van.Atteveldt'.
> Msg 20014, Level 9, State 0, Server OpenClient, Line 0
> Login incorrect.
> There was a problem connecting to the server
> 
> (There is a separate domain controller that I probably need to login
> onto.)
> 
> Is it at all possible to use 'integrated security' using freetds? It
> seems a bit simplistic to just send the domain name and password if
the
> server requires a 'trusted connection', which to me sounds like
Kerberos
> and all kind of heaby protocols. Not that I know anything about
that...
> 
> 2) 'Force Protocol Encryption': SSL / TLS
> 
> The new SQL Server SP has a flag that forces connections to be made
> using encryption. If I am correct, this means connecting over an SSL /
> TLS layer.
> 
> a) I have seen some recent messages that support for this has been
built
> into freeTDS. Is this correct? How can I enable this?
> 
> b) Can I use stunnel to connect to the remote sql server? Is there any
> help on getting this to work? If I install stunnel, set
> /usr/local/etc/stunnel/stunnel.conf to cliet=yes and add:
> 
> [sqlserver]
> accept=1434
> connect=fswap02.scw.vu.nl:1433
> 
> And then run stunnel, nothing at all happens, and localhost:1434 times
> out...
> 
> Any help greatly appreciated!
> 
> Wouter
> 
> 
> _______________________________________________
> FreeTDS mailing list
> FreeTDS AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/freetds
> _______________________________________________
> FreeTDS mailing list
> FreeTDS AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/freetds