FreeTDS Development Group

[Brian Morton <bmorton AT secureworks.com>]

In response to item #3 (I do quite a bit of php), how is this insecure?  Are
you concerned that someone will access the source of your script and view
the login information?  If so, the proper way to go about this is to find
why you are concerned about that (escalation of privs through another
script?) and close that vulnerability.  There is no reason to have an
irrational fear of someone getting your credentials hardcoded in a script.
It's just like any other password file.  Another idea is to store the
credentials in a separate password file outside of the webroot, and have php
read the file for the information. 

-----Original Message-----
From: Lowden, James K [mailto:LowdenJK AT bernstein.com] 
Sent: Thursday, January 26, 2006 10:05 AM
To: FreeTDS Development Group
Subject: Re: [freetds] How can I connect to MS SQL Server without store user
&password in php file?

> From: mario.freire AT caixa.gov.br
> Sent: Thursday, January 26, 2006 6:41 AM
> 
> Thank you, James K. Lowden!

You're welcome.  :-)

> 1) What is "a/k/a trusted connection"?

Sorry.  "a/k/a" is an English abbreviation for "also known as".  The
technology has different names.  IMO the clearest name is "domain login".  

> 2) So I only need to use the form DOMAIN\username and then the 
> password will be sent encrypted? It is not necessary to do any other 
> configuration or call a special function? Which encrypt protocol will 
> be used?

On a Windows machine, the username (and password?) is cached by the OS.
When you do:

        C:\> isql -E

isql.exe tells the OS to send the cached username and password to the
server.  The password isn't sent in the clear; it's encrypted.  How doesn't
really matter here, except that it's a well known challenge-and-response
protocol.  It's also implemented by Samba among others.  

With FreeTDS there is no cache to draw on, so you provide the username and
password.  FreeTDS recognizes the '\' character in the username as an
indication to emulate 'isql.exe -E' i.e. to perform a domain login.  

Across the wire, the server cannot distinguish between isql.exe and
(say) freebcp.  

> 3) Send an encrypted password through the network solves part of the 
> problem. But the password will still be stored in the php file, which 
> is considered insecure... Can I inform the user name and password in a 
> file more protected, not acessible by the browser?

I'm not a PHP or web guru.  This is done all the time by people who know
how, though.  I'm sure you find the answer, if not here then elsewhere.


HTH.  

--jkl

-----------------------------------------
The information contained in this transmission may be privileged and
confidential and is intended only for the use of the person(s) named above.
If you are not the intended recipient, or an employee or agent responsible
for delivering this message to the intended recipient, any review,
dissemination, distribution or duplication of this communication is strictly
prohibited. If you are not the intended recipient, please contact the sender
immediately by reply e-mail and destroy all copies of the original message.
Please note that we do not accept account orders and/or instructions by
e-mail, and therefore will not be responsible for carrying out such orders
and/or instructions.  If you, as the intended recipient of this message, the
purpose of which is to inform and update our clients, prospects and
consultants of developments relating to our services and products, would not
like to receive further e-mail correspondence from the sender, please
"reply" to the sender indicating your wishes.  In the U.S.: 1345 Avenue of
the Americas, New York, NY 10105.
_______________________________________________
FreeTDS mailing list
FreeTDS AT lists.ibiblio.org
http://lists.ibiblio.org/mailman/listinfo/freetds