[freetds] Multiple server challenge packets during NTLM authentication

[Vipul Sharma]

Hello,

While running my tests using tsql client, i found that if server sends
multiple NTLM Challenge packets, then tsql generates a new NTLM AUTH packet
for every Challenge packet. The sequence is as follows :

Client -> Server (NTLM Negotiate packet)
Server -> Client (NTLM Challenge packet)
Client -> Server (NTLM AUTH packet)
Server -> Client (NTLM Challenge packet)
Client -> Server (NTLM AUTH packet)

Is this supported by NTLM protocol ? I tested the same sequence with other
TDS clients(SQL Server Studio) and it threw an error.

Is this a bug ? Can somebody please shed some light on this ?

Thanks,
Vipul

[Frediano Ziglio]

Post by Vipul Sharma
Hello,
While running my tests using tsql client, i found that if server sends
multiple NTLM Challenge packets, then tsql generates a new NTLM AUTH packet
Client -> Server (NTLM Negotiate packet)
Server -> Client (NTLM Challenge packet)
Client -> Server (NTLM AUTH packet)
Server -> Client (NTLM Challenge packet)
Client -> Server (NTLM AUTH packet)

Are you sure is not Kerberos ?? For Kerberos (or gssapi) is normal.
SSPI support both NTLM and Kerberos so perhaps it's using Kerberos. If
server connected it definitively is.

Post by Vipul Sharma
Is this supported by NTLM protocol ? I tested the same sequence with other
TDS clients(SQL Server Studio) and it threw an error.
Is this a bug ? Can somebody please shed some light on this ?
Thanks,
Vipul

Frediano