Re: FreeTDS + SQL Server + NTLM v2?

Added a "use ntlmv2" option to freetds.conf and a UseNTLMv2 odbc parameter.
Windows clients sends NTLMv2 only when this option is used in local
policy settings (which could be override by domain policies).

freddy77

2010/11/9 Frediano Ziglio <[email protected]>:
> 2010/11/8 Samuel Bayer <[email protected]>:
>> Hi all -
>>
>> I'm a new user of FreeTDS. I'm using a very recent snapshot
>> (freetds-0.83.dev.20101105) because the comments on this list implied that
>> these recent snapshots contain support for NTLM v2, and in fact default to
>> NTLM v2 when presented with a domain login. I have an SQL Server instance,
>> which I don't manage, which is configured to accept NTLM v2 only. I attempt
>> to contact it from my Mac (running Snow Leopard, not a member of the Windows
>> domain) via a DSN-less connection as follows, and get the following error:
>>
>> ------------------------------------
>>
>> $ TDSVER=8.0 tsql -H <server> -p 1433 -U '<domain>\sam'
>> Password:
>> locale is "C"
>> locale charset is "US-ASCII"
>> using default charset "ISO-8859-1"
>> Msg 18452 (severity 14, state 1) from DEPOTSQL Line 1:
>>        "Login failed. The login is from an untrusted domain and cannot be
>> used with Windows authentication."
>> Error 20002 (severity 9):
>>        Adaptive Server connection failed
>> There was a problem connecting to the server
>>
>> -------------------------------------
>>
>> where <server> is the FQDN of my server, and <domain> is the domain  the SQL
>> Server is a member of, which is a domain in which the user "sam" (which is
>> me) has an account.
>>
>> Now, I know I can contact this DB; I've used the jTDS JDBC driver to contact
>> this same database from my Mac using the following DB connection string:
>>
>> jdbc:jtds:sqlserver://<server>:1433;DatabaseName=<db>;domain=<domain>;useNTLMv2=true
>>
>> If I omit "useNTLMv2=true", I get exactly the same error I'm getting with
>> the tsql command above.
>>
>> If FreeTDS defaults to NTLM v2, why I am getting this error with tsql?
>>
>> Thanks to all in advance -
>>
>> Sam Bayer
>> The MITRE Corporation
>> [email protected]
>
> Quite strange problem... I would like to know the better way to detect
> NTLMv2 safely... There is no flag for NTLMv2 so we ask for NTLM2 and
> server reply NTLM2 but we use NTLM2 while server expect NTLMv2!
>
> A year ago I merged a patch
>
> http://freetds.cvs.sourceforge.net/viewvc/freetds/freetds/src/tds/challenge.c?r1=1.39&r2=1.40
>
> and sent a mail
>
> http://lists.ibiblio.org/pipermail/freetds/2009q3/025192.html
>
> and I remember this fixed a problem for me but today I tried to force
> NTLMv2 instead and connection works with NTLMv2 (my server accept
> NTLM, NTLM2 and NTLMv2). I would like to know which environments
> (older one surely!) support NTLM2 but not NTLMv2. I added a code in
> CVS HEAD (lines 653 and 654, see
> http://freetds.cvs.sourceforge.net/viewvc/freetds/freetds/src/tds/challenge.c?revision=1.44&view=markup)
> but I commented them... try to enable them (replacing "#if 0" with
> "#if 1"). Well.. I bet code will work.
>
> freddy77
>
_______________________________________________
FreeTDS mailing list
[email protected]
http://lists.ibiblio.org/mailman/listinfo/freetds