FreeTDS Development Group

[Plot Lost <plot.lost AT gmail.com>]

On Thu, Oct 7, 2010 at 2:23 AM, Ryan Lavelle <rylavelle AT gmail.com> wrote:

> I've setup freeTDS 0.82 with encryption=required under the DNS info in the
> freetds.conf to a SQL Server 2005 server, with
> TDS version 8 and have been using tcpdump to view the packets going from
> and
> to my host machine to make sure the connection
> is encrypted, it connects but when I view the TCPDump, I can clearly see
> the
> SQL statement I'm passing and records returned as
> plain chars and unencrypted, is this normal?   I thought it would encrypt
> the entire connection not just the login, what's weird is if I recompile
> freeTDS without the --with-openssl or --with-gnutls, it's still able to
> connect even though encryption=required is set.
>
> Regards,
>
> Ryan Lavelle
>

 If no SSL library is included (openssl or gnutls) then FreeTDS 0.82 does
not check the encryption setting, instead it relies on the server rejecting
the connection. The server will only reject the connection if it has
encryption required set wihin it's own config.

This has been changed in the nightly snapshot (0.83) - you could try that to
see if it helps, with the usual caveats about using nightly releases...

>From my recent experience of this, OpenSSL does not work as expected - only
GnuTLS is able to connect correctly.