FreeTDS Development Group

[Frediano Ziglio <freddy77 AT gmail.com>]

Il giorno ven, 01/08/2008 alle 10.59 -0700, Peter Deacon ha scritto:
> On Fri, 1 Aug 2008, Frediano Ziglio wrote:
> 
> > Il giorno gio, 31/07/2008 alle 18.25 -0400, Sergey Sikorskiy ha scritto:
> >> Hi,
> 
> >> I've just checked with Microsoft web-site and found detailed
> >> documentation for NTLM.
> >> http://msdn.microsoft.com/en-us/library/cc207842.aspx
> 
> >> This documentation clearly says that "(1.7) "The NTLM authentication
> >> version is not negotiated by the protocol. It must be configured on
> >> both the client and the server prior to authentication. The version is
> >> selected by the client, and requested during the protocol negotiation.
> >> If the server does not support the version selected by the client,
> >> authentication fails."
> 
> >> The rest is negotiable, including sending of LMv2 hash, which won't be
> >> sent in my implementation.
> 
> > yes, but I think that client should say: I support all these and server
> > reply, you can use such... If we support all versions we should be
> > always able to negotiate the correct (most secure) authentication.
> > I think that is NTLM2 is negotiated either NTLMv2 or NTLM2 should be
> > used. At this point I think that if we have valid Target Info NTLMv2
> > should be negotiated...
> 
> IMHO with these sorts of things where there is no serious machinary to 
> perform secure protocol negotiation both client and server side 
> configuration is required to prevent attacks which can cause less secure 
> protocols being negotiated in order to take advantage of a weakness.
> 
> For example v2 supports mutual authentication, earlier protocols did not. 
> If your able to MITM the connection and negotiate a protocol without 
> mutual auth ... there is little point remaining in having v2 as its 
> enhanced security properties can simply be bypassed.
> 

Well... MS client have a concept of minimun security, forced usually
with group policy. Some sort of "do not use LM" or "don't use
authentications below NTLMv2". Currently not implemented by our library
but we could do in a near future.

How does it work this sort of mutual authentication in NTLMv2 ??

Frediano