Skip to Content.
Sympa Menu

freetds - Re: [freetds] How can I connect to MS SQL Server without store user &password in php file?

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: "Lowden, James K" <LowdenJK AT bernstein.com>
  • To: "FreeTDS Development Group" <freetds AT lists.ibiblio.org>
  • Subject: Re: [freetds] How can I connect to MS SQL Server without store user &password in php file?
  • Date: Thu, 26 Jan 2006 10:05:02 -0500

> From: mario.freire AT caixa.gov.br
> Sent: Thursday, January 26, 2006 6:41 AM
>
> Thank you, James K. Lowden!

You're welcome. :-)

> 1) What is "a/k/a trusted connection"?

Sorry. "a/k/a" is an English abbreviation for "also known as". The
technology has different names. IMO the clearest name is "domain
login".

> 2) So I only need to use the form DOMAIN\username and then the
> password will be sent encrypted? It is not necessary to do any
> other configuration or call a special function? Which encrypt
> protocol will be used?

On a Windows machine, the username (and password?) is cached by the OS.
When you do:

C:\> isql -E

isql.exe tells the OS to send the cached username and password to the
server. The password isn't sent in the clear; it's encrypted. How
doesn't really matter here, except that it's a well known
challenge-and-response protocol. It's also implemented by Samba among
others.

With FreeTDS there is no cache to draw on, so you provide the username
and password. FreeTDS recognizes the '\' character in the username as
an indication to emulate 'isql.exe -E' i.e. to perform a domain login.

Across the wire, the server cannot distinguish between isql.exe and
(say) freebcp.

> 3) Send an encrypted password through the network solves part of
> the problem. But the password will still be stored in the php file,
> which is considered insecure... Can I inform the user name and
> password in a file more protected, not acessible by the browser?

I'm not a PHP or web guru. This is done all the time by people who know
how, though. I'm sure you find the answer, if not here then elsewhere.


HTH.

--jkl

-----------------------------------------
The information contained in this transmission may be privileged and
confidential and is intended only for the use of the person(s) named
above. If you are not the intended recipient, or an employee or agent
responsible
for delivering this message to the intended recipient, any review,
dissemination,
distribution or duplication of this communication is strictly prohibited. If
you are
not the intended recipient, please contact the sender immediately by reply
e-mail
and destroy all copies of the original message. Please note that we do not
accept
account orders and/or instructions by e-mail, and therefore will not be
responsible
for carrying out such orders and/or instructions. If you, as the intended
recipient
of this message, the purpose of which is to inform and update our clients,
prospects
and consultants of developments relating to our services and products, would
not
like to receive further e-mail correspondence from the sender, please "reply"
to the
sender indicating your wishes. In the U.S.: 1345 Avenue of the Americas, New
York,
NY 10105.



  • Re: [freetds] How can I connect to MS SQL Server without store user &password in php file?, Lowden, James K, 01/26/2006

Archive powered by MHonArc 2.6.24.

Top of Page