🚀 go-pugleaf

In article <mfv.2.00088E3E@ornl.gov>,  <mfv@ornl.gov> wrote:
>Let me preface my question by saying that I know absolutely nothing about 
>MS SQL Server.  I have been asked to find out how SQL running on NT 3.5 
>handles passwords.  I was told that SQL used to store passwords in clear 
>text, has that changed?  If SQL is running under NT 3.5, does it rely on the 
>NT authentication process?
>
>If there are any books or an FAQ source, I would appreciate knowing where to 
>look.

From what I recall, the SQL security model will pass userid and passwords
in clear text, so you are vulnerable to a network snooping attack.

MS SQLServer can be configured to run in what is known as an "integrated"
security mode.  This allows MS clients be authenticated by the NT
security model.  This does not pass passwords in clear text.  The downside
to this model is that you may have difficulty finding non-Microsoft client
software that supports this model (ie. MAC or Unix).

For more info on MS SQLServer, check out:

  ftp.microsoft.com/bussys/sql_odbc/sql-mrktg

Regards,
Mike