all groups > sql server connect > february 2004 >
You're in the

sql server connect

group:

Problem with NT authentication


Re: Problem with NT authentication Bala Neerumalla[MSFT]
2/20/2004 9:32:38 AM
sql server connect:
This is the expected behavior. Since both the machines have same
administrator password, when you try to connect from system2 to system1,
system2 uses NTLM Authentication protocol (which in turn uses the current
user's credentails) to authenticate against System1's SAM database. Since
the administrator password is same, the connection succeeds. In fact this is
not specific to SQL Server, if you go to command prompt and do a net use to
C$ on system1 you would successfully map a drive to that c$.

Logged on user on System1 doesnt have any role in this. In face each network
login gets his own logon session.

Thanks,
Bala Neerumalla.

--
This posting is provided "AS IS" with no warranties, and confers no
rights.
[quoted text, click to view]

Problem with NT authentication Srinivasa Rao B
2/20/2004 9:56:23 PM
Hi,
Pleae consider this scenario, where I have 2 systems on the same domain and
named as system1 and system2. Two systems have Administrator logins as their
local login, not part of domain and these two have same password say 123456

System1 has database installed with that and NT authentication enabled. I
have one more domain account on system1 with which i have logged in. On
system2 I have logged in using local admin of system2. Now on system2, I
configure one DSN, and that connects to system1 with NT authentication.
Actually it should fail as this local admin does not have any previliges
over system1.

Surprisingly it got connected to the database on the system1. Same behaviour
with Enterprise manager also.

Do not you think its a bug with SQL server?

Regards
BSR

Re: Problem with NT authentication Srinivasa Rao B
2/21/2004 2:12:31 PM
Firstly:
How local user's credential can be used on remote machine?. When we are
trying to connect to a remote machine (consider system2 here) the use name
should be system1\Administrator not Administrator alone. User does not know
what protocol you use and it does not matter to him. I consider this as a
security breach. Why becuase this Administrator on system2 is local to that
machine and does not have any permission on system1. System1 should not
allow him to logon from system2.

Second: This works if two machines are on the same domain. Please explain me
this.

Regards
BSR

[quoted text, click to view]

AddThis Social Bookmark Button