Re: FreeTDS + SQL Server + NTLM v2?

2010/11/8 Samuel Bayer <[email protected]>:
> Hi all -
>
> I'm a new user of FreeTDS. I'm using a very recent snapshot
> (freetds-0.83.dev.20101105) because the comments on this list implied that
> these recent snapshots contain support for NTLM v2, and in fact default to
> NTLM v2 when presented with a domain login. I have an SQL Server instance,
> which I don't manage, which is configured to accept NTLM v2 only. I attempt
> to contact it from my Mac (running Snow Leopard, not a member of the Windows
> domain) via a DSN-less connection as follows, and get the following error:
>
> ------------------------------------
>
> $ TDSVER=8.0 tsql -H <server> -p 1433 -U '<domain>\sam'
> Password:
> locale is "C"
> locale charset is "US-ASCII"
> using default charset "ISO-8859-1"
> Msg 18452 (severity 14, state 1) from DEPOTSQL Line 1:
>        "Login failed. The login is from an untrusted domain and cannot be
> used with Windows authentication."
> Error 20002 (severity 9):
>        Adaptive Server connection failed
> There was a problem connecting to the server
>
> -------------------------------------
>
> where <server> is the FQDN of my server, and <domain> is the domain  the SQL
> Server is a member of, which is a domain in which the user "sam" (which is
> me) has an account.
>
> Now, I know I can contact this DB; I've used the jTDS JDBC driver to contact
> this same database from my Mac using the following DB connection string:
>
> jdbc:jtds:sqlserver://<server>:1433;DatabaseName=<db>;domain=<domain>;useNTLMv2=true
>
> If I omit "useNTLMv2=true", I get exactly the same error I'm getting with
> the tsql command above.
>
> If FreeTDS defaults to NTLM v2, why I am getting this error with tsql?
>
> Thanks to all in advance -
>
> Sam Bayer
> The MITRE Corporation
> [email protected]

Quite strange problem... I would like to know the better way to detect
NTLMv2 safely... There is no flag for NTLMv2 so we ask for NTLM2 and
server reply NTLM2 but we use NTLM2 while server expect NTLMv2!

A year ago I merged a patch

http://freetds.cvs.sourceforge.net/viewvc/freetds/freetds/src/tds/challenge.c?r1=1.39&r2=1.40

and sent a mail

http://lists.ibiblio.org/pipermail/freetds/2009q3/025192.html

and I remember this fixed a problem for me but today I tried to force
NTLMv2 instead and connection works with NTLMv2 (my server accept
NTLM, NTLM2 and NTLMv2). I would like to know which environments
(older one surely!) support NTLM2 but not NTLMv2. I added a code in
CVS HEAD (lines 653 and 654, see
http://freetds.cvs.sourceforge.net/viewvc/freetds/freetds/src/tds/challenge.c?revision=1.44&view=markup)
but I commented them... try to enable them (replacing "#if 0" with
"#if 1"). Well.. I bet code will work.

freddy77
_______________________________________________
FreeTDS mailing list
[email protected]
http://lists.ibiblio.org/mailman/listinfo/freetds