Re: Backporting NTLMv2 (was: NTLMv2 support for domain logins using freetds)

Il giorno gio, 31/07/2008 alle 18.25 -0400, Sergey Sikorskiy ha scritto:
> Hi,
> 
> I've just checked with Microsoft web-site and found detailed
> documentation for NTLM.
> 
> http://msdn.microsoft.com/en-us/library/cc207842.aspx
> 
> This documentation clearly says that "(1.7) "The NTLM authentication
> version is not negotiated by the protocol. It must be configured on
> both the client and the server prior to authentication. The version is
> selected by the client, and requested during the protocol negotiation.
> If the server does not support the version selected by the client,
> authentication fails."
> 
> The rest is negotiable, including sending of LMv2 hash, which won't be
> sent in my implementation.
> 

yes, but I think that client should say: I support all these and server
reply, you can use such... If we support all versions we should be
always able to negotiate the correct (most secure) authentication.
I think that is NTLM2 is negotiated either NTLMv2 or NTLM2 should be
used. At this point I think that if we have valid Target Info NTLMv2
should be negotiated...

> After looking over documentation I figured out that negotiation part
> is almost completely missing in my implementation. I'm sorry, but this
> documentation wasn't available two years ago.
> 

Mmmm... not that hard to implement...

freddy77