Re: SSL Encryption Test
From: Matt Neerincx [MSFT] (mattn_at_online.microsoft.com)
Date: 09/30/05
- Previous message: Mike Epprecht \(SQL MVP\): "Re: Access Denied Error when attaching a Database file"
- In reply to: xxdanbrowne_at_gmail.com: "Re: SSL Encryption Test"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Thu, 29 Sep 2005 18:52:02 -0700
There are currently 2 modes of SSL with SQL.
Client side initiated SSL encryption and server-side SSL encryption.
Server side SSL encryption is enabled via the "Force Protocol Encryption"
settting on the server, you have discovered this already.
With Server side SSL, the client does not validate the SSL certificate at
all, it just uses it to encrypt the traffic.
With client side initiated SSL encryption, the client will both verify that
it trusts the root CA of the certificate as well as validate that the target
server is properly embedded in the certificate (mutual authentication). So
client side intiated SSL is more stringent.
However, you cannot use SSL to deny users access to the server (or for
client authentication like you can with IIS), SSL is only used to encrypt
the data over the wire with SQL. But that is actually a good idea I'll
bring to the next meeting we have about future of TDS protocol, I think
this would be a nice feature to have.
-- Matt Neerincx [MSFT] This posting is provided "AS IS", with no warranties, and confers no rights. Please do not send email directly to this alias. This alias is for newsgroup purposes only. <xxdanbrowne@gmail.com> wrote in message news:1128005350.799985.234510@z14g2000cwz.googlegroups.com... > Correction: It looks like it is actually *working*. > I sniffed the packets with force encryption on and cannot see anything > intelligible. > I sniffed the packets with force encryption off and I can make out > everything passing back and forth between the sql server and the > client. > > What is wierd as far as I'm concerned is how this is supposed to secure > the system if *anybody* can connect. Basically the only protection it > gives you is preventing packets from being sniffed and read, so someone > could *still* connect using SSL and run a dictionary attack trying to > guess sa if they knew what port you were on. >
- Previous message: Mike Epprecht \(SQL MVP\): "Re: Access Denied Error when attaching a Database file"
- In reply to: xxdanbrowne_at_gmail.com: "Re: SSL Encryption Test"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
