FreeTDS Development Group

["Frank M. Kromann" <frank AT kromann.info>]

The simple way of obtaining this is to create a file outside the web
structure

<?php
$strUser = "DOMAIN\\User";
$strPassword = "My Password";
?>

In yoy php script file you will then use include("password.inc"); (or
whatwver the file is called).

You need to specify the path to the directorty where the file is included
from in php.ini.

- Frank

> In response to item #3 (I do quite a bit of php), how is this insecure? 
Are
> you concerned that someone will access the source of your script and
view
> the login information?  If so, the proper way to go about this is to
find
> why you are concerned about that (escalation of privs through another
> script?) and close that vulnerability.  There is no reason to have an
> irrational fear of someone getting your credentials hardcoded in a
script.
> It's just like any other password file.  Another idea is to store the
> credentials in a separate password file outside of the webroot, and have
php
> read the file for the information. 
> 
> -----Original Message-----
> From: Lowden, James K [mailto:LowdenJK AT bernstein.com] 
> Sent: Thursday, January 26, 2006 10:05 AM
> To: FreeTDS Development Group
> Subject: Re: [freetds] How can I connect to MS SQL Server without store
user
> &password in php file?
> 
> > From: mario.freire AT caixa.gov.br
> > Sent: Thursday, January 26, 2006 6:41 AM
> > 
> > Thank you, James K. Lowden!
> 
> You're welcome.  :-)
> 
> > 1) What is "a/k/a trusted connection"?
> 
> Sorry.  "a/k/a" is an English abbreviation for "also known as".  The
> technology has different names.  IMO the clearest name is "domain
login".  
> 
> > 2) So I only need to use the form DOMAIN\username and then the 
> > password will be sent encrypted? It is not necessary to do any other 
> > configuration or call a special function? Which encrypt protocol will

> > be used?
> 
> On a Windows machine, the username (and password?) is cached by the OS.
> When you do:
> 
>       C:\> isql -E
> 
> isql.exe tells the OS to send the cached username and password to the
> server.  The password isn't sent in the clear; it's encrypted.  How
doesn't
> really matter here, except that it's a well known
challenge-and-response
> protocol.  It's also implemented by Samba among others.  
> 
> With FreeTDS there is no cache to draw on, so you provide the username
and
> password.  FreeTDS recognizes the '\' character in the username as an
> indication to emulate 'isql.exe -E' i.e. to perform a domain login.  
> 
> Across the wire, the server cannot distinguish between isql.exe and
> (say) freebcp.  
> 
> > 3) Send an encrypted password through the network solves part of the 
> > problem. But the password will still be stored in the php file, which

> > is considered insecure... Can I inform the user name and password in a

> > file more protected, not acessible by the browser?
> 
> I'm not a PHP or web guru.  This is done all the time by people who
know
> how, though.  I'm sure you find the answer, if not here then elsewhere.
> 
> 
> HTH.  
> 
> --jkl
> 
> -----------------------------------------
> The information contained in this transmission may be privileged and
> confidential and is intended only for the use of the person(s) named
above.
> If you are not the intended recipient, or an employee or agent
responsible
> for delivering this message to the intended recipient, any review,
> dissemination, distribution or duplication of this communication is
strictly
> prohibited. If you are not the intended recipient, please contact the
sender
> immediately by reply e-mail and destroy all copies of the original
message.
> Please note that we do not accept account orders and/or instructions by
> e-mail, and therefore will not be responsible for carrying out such
orders
> and/or instructions.  If you, as the intended recipient of this message,
the
> purpose of which is to inform and update our clients, prospects and
> consultants of developments relating to our services and products, would
not
> like to receive further e-mail correspondence from the sender, please
> "reply" to the sender indicating your wishes.  In the U.S.: 1345 Avenue
of
> the Americas, New York, NY 10105.
> _______________________________________________
> FreeTDS mailing list
> FreeTDS AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/freetds
> _______________________________________________
> FreeTDS mailing list
> FreeTDS AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/freetds
>