FreeTDS Development Group

[Ryan Lavelle <rylavelle AT gmail.com>]

On Wed, Oct 6, 2010 at 10:54 PM, Plot Lost <plot.lost AT gmail.com> wrote:

> On Thu, Oct 7, 2010 at 2:23 AM, Ryan Lavelle <rylavelle AT gmail.com> wrote:
>
> > I've setup freeTDS 0.82 with encryption=required under the DNS info in
> the
> > freetds.conf to a SQL Server 2005 server, with
> > TDS version 8 and have been using tcpdump to view the packets going from
> > and
> > to my host machine to make sure the connection
> > is encrypted, it connects but when I view the TCPDump, I can clearly see
> > the
> > SQL statement I'm passing and records returned as
> > plain chars and unencrypted, is this normal?   I thought it would encrypt
> > the entire connection not just the login, what's weird is if I recompile
> > freeTDS without the --with-openssl or --with-gnutls, it's still able to
> > connect even though encryption=required is set.
> >
> > Regards,
> >
> > Ryan Lavelle
> >
>
>  If no SSL library is included (openssl or gnutls) then FreeTDS 0.82 does
> not check the encryption setting, instead it relies on the server rejecting
> the connection. The server will only reject the connection if it has
> encryption required set wihin it's own config.
>
> This has been changed in the nightly snapshot (0.83) - you could try that
> to
> see if it helps, with the usual caveats about using nightly releases...
>
> From my recent experience of this, OpenSSL does not work as expected - only
> GnuTLS is able to connect correctly.
> _______________________________________________
>

Ok I recompiled with Gnutls, and now I see something about SSL-Self Signed
fallback in the tcp dump, is that because the server does not have an SSL
certificate? Because I can still see some plain-text unencrypted chars in
the tcp dump.