FreeTDS Development Group

[Frediano Ziglio <freddyz77 AT tin.it>]

Il giorno ven, 23/06/2006 alle 18.52 +0300, Iliyan Peychev ha scritto:
> Hi,
> 
> I am asking for help, related to NTLM and MS SQL 2000, running on Windows
> 2003. I really sorry, if I disturb you and this message is not for this
> forum.
> 
> 
> Here is the problem:
> 
> I am trying to write a program, which is working as "proxy" between Query
> Analyzer, or some other client and MS SQL Server 2000. My program has to
> capture packets, to deal with them and to forward them to MS SQL Server.
> 
> I am using Ethereal for capturing packets.
> Query Analyzer uses Windows authentication to log in.
> 
> The problem is:
> The packets, which Query Analyzer sends, are not just these "raw"
> packages, described in NTLM documentation. Instead, it seems it is working
> by using SPNEGO protocol - inside the captured packet, just after Library
> Name, instead NTLMSSP, there is "GSS-API Generic Security Service
> Application Program Interface". Below Ethereal shows "SPNEGO" also.
> 
> SPNEGO contains NTLM data.
> 
> So, I think it is working as described here:
> http://davenport.sourceforge.net/ntlm.html#ntlmsspAndSspi
> 
> The problem is:
> 
> After manually calcluation of LM Response and NTLM response, they seems
> "wrong", i.e. they are different than those, Query Analyzer sends in Type
> 3 message. I am sure the algorithm is not wrong, because the same code is
> working properly with jTDS for example. Of course, I am also sure I pass
> as parameters correct password and challenge - these, extracted from
> captured packet.
> 
> Do you have an idea is the algorithm of calculation LM response and NTLM
> response different in case of using SPNEGO?
> What could be the reason for this issue?
> 

Hi!
  Probably there is some bit that enable feature like crypting or some
other feature. It would be helpful if you could use a test account and
post some network capture. Or, if you prefer, post privately to me.
I never say a SPNEGO with mssql...

freddy77