Algorithm used to encrypt password in sysxlogin

Hi,

Does anyone know which algorithm is being used to encrypt the passwords in the sysxlogins for SQL Server 2000? I've been googling for some time..but I can't seem to find this information. Please help.

Many thanks,

Leona

Laurentiu wrote a really good article on this topic, I hope you will find it useful:

http://blogs.msdn.com/lcris/archive/2007/04/30/sql-server-2005-about-login-password-hashes.aspx

-Raul Garcia

SDE/T

SQL Server Engine

|||

Hi Raul,

Thanks for the link provision. Yeah, I saw this information too after so much googling yesterday and I agree it's good. However, it's a pity it ain't official. I was hoping to find the information from an official source, like the MSDN online docs, knowledge base etc. I'm surprised that I can't seem to locate this information...

Cheers,

Leona

|||

Sometimes we don’t have “officially” documentation because of honest mistakes in the process and the intended documentation doesn’t exist at all, in such cases I encourage everyone to give us the proper feedback and we will open bugs for our BOL and try to get them fixed (not always possible due to resource limitations, and I apologize for that); but in other occasions some parts of a feature are not documented on purpose for good reason: if necessary, we reserve the rights to change the implementation.

As Laurentiu mentioned in his article, previous versions of the algorithm were different, and even opened the possibility for attempting to break the passwords via the case-insensitive hashes (as documented by David Litchfield). If the password algorithm would have been fully documented and supported, we may be still in the need to face the same documented weakness in favor of backwards compatibility (probably with some obscure knob to disable), as some applications may still be using it and we would need to go through the (painful) deprecation process.

On the other hand, we don’t believe in security by obscurity, and whenever we have the opportunity some members of the SQL Server team (and sometimes even former members of the team, kudos to Laurentiu for all his help) like to “unofficially” document some features according to our customers feedback or questions in the forums and/or our msdn blogs or when we believe it is useful information that should be documented, but for some reason is not officially documented.

While information on our blogs is not considered “official”, at least I know Laurentiu and I try to validate it and make sure the information and samples we provide are valid (and hopefully useful) because we are trying to help the SQL Server community.

We really appreciate all your feedback as it helps us to improve.

Thanks a lot,

-Raul Garcia

SDE/T

SQL Server Engine

Algorithm used to encrypt password in sysxlogin

Hi,

Does anyone know which algorithm is being used to encrypt the passwords in the sysxlogins for SQL Server 2000? I've been googling for some time..but I can't seem to find this information. Please help.

Many thanks,

Leona

Laurentiu wrote a really good article on this topic, I hope you will find it useful:

http://blogs.msdn.com/lcris/archive/2007/04/30/sql-server-2005-about-login-password-hashes.aspx

-Raul Garcia

SDE/T

SQL Server Engine

|||

Hi Raul,

Thanks for the link provision. Yeah, I saw this information too after so much googling yesterday and I agree it's good. However, it's a pity it ain't official. I was hoping to find the information from an official source, like the MSDN online docs, knowledge base etc. I'm surprised that I can't seem to locate this information...

Cheers,

Leona

|||

Sometimes we don’t have “officially” documentation because of honest mistakes in the process and the intended documentation doesn’t exist at all, in such cases I encourage everyone to give us the proper feedback and we will open bugs for our BOL and try to get them fixed (not always possible due to resource limitations, and I apologize for that); but in other occasions some parts of a feature are not documented on purpose for good reason: if necessary, we reserve the rights to change the implementation.

As Laurentiu mentioned in his article, previous versions of the algorithm were different, and even opened the possibility for attempting to break the passwords via the case-insensitive hashes (as documented by David Litchfield). If the password algorithm would have been fully documented and supported, we may be still in the need to face the same documented weakness in favor of backwards compatibility (probably with some obscure knob to disable), as some applications may still be using it and we would need to go through the (painful) deprecation process.

On the other hand, we don’t believe in security by obscurity, and whenever we have the opportunity some members of the SQL Server team (and sometimes even former members of the team, kudos to Laurentiu for all his help) like to “unofficially” document some features according to our customers feedback or questions in the forums and/or our msdn blogs or when we believe it is useful information that should be documented, but for some reason is not officially documented.

While information on our blogs is not considered “official”, at least I know Laurentiu and I try to validate it and make sure the information and samples we provide are valid (and hopefully useful) because we are trying to help the SQL Server community.

We really appreciate all your feedback as it helps us to improve.

Thanks a lot,

-Raul Garcia

SDE/T

SQL Server Engine

Algorithm to encrypt the password into Security directory

Hi,

I need know what algorithm to encrypt the password into Security Directory, if anybody know the name.

Thanks

What is the Security directory you mentioned?

Thanks

Laurentiu

sql

After password change, cannot connect to SQL servers.

We have 4 instances of SQL running on 4 different servers. We recently
had to change our administrator password. After doing that, we cannot
connect from our computers (Windows XP SP2) to any of our SQL servers
(1 Windows Server 2000, 3 Windows Server 2003). We see the following
error:
A connection could not be established to "servername"
Reason: Cannot generate SSPI context.
Please verify that SQL Server is running and check your SQL Server
registration properties and try again.
Any Ideas?
Check this article and see if it helps.
http://support.microsoft.com/default...b;en-us;811889
VM
"jgrubbs@.pgsd.org" wrote:

> We have 4 instances of SQL running on 4 different servers. We recently
> had to change our administrator password. After doing that, we cannot
> connect from our computers (Windows XP SP2) to any of our SQL servers
> (1 Windows Server 2000, 3 Windows Server 2003). We see the following
> error:
> A connection could not be established to "servername"
> Reason: Cannot generate SSPI context.
> Please verify that SQL Server is running and check your SQL Server
> registration properties and try again.
> Any Ideas?
>

After password change, cannot connect to SQL servers.

We have 4 instances of SQL running on 4 different servers. We recently
had to change our administrator password. After doing that, we cannot
connect from our computers (Windows XP SP2) to any of our SQL servers
(1 Windows Server 2000, 3 Windows Server 2003). We see the following
error:
A connection could not be established to "servername"
Reason: Cannot generate SSPI context.
Please verify that SQL Server is running and check your SQL Server
registration properties and try again.
Any Ideas?Could be an issue with your SPN - you can find more info and
troubleshooting steps for the error in the following
article:
How to troubleshoot the "Cannot generate SSPI context" error
message
http://support.microsoft.com/?id=811889
-Sue
On 17 Jan 2006 05:43:12 -0800, "jgrubbs@.pgsd.org"
<jgrubbs@.pgsd.org> wrote:

>We have 4 instances of SQL running on 4 different servers. We recently
>had to change our administrator password. After doing that, we cannot
>connect from our computers (Windows XP SP2) to any of our SQL servers
>(1 Windows Server 2000, 3 Windows Server 2003). We see the following
>error:
>A connection could not be established to "servername"
>Reason: Cannot generate SSPI context.
>Please verify that SQL Server is running and check your SQL Server
>registration properties and try again.
>Any Ideas?|||Thanks, we figured out the issue. The SQLSERVER and the SQLSERVERAGENT
service were set to use the old password. Once we changed this, we
were able to connect.

After password change, cannot connect to SQL servers.

We have 4 instances of SQL running on 4 different servers. We recently
had to change our administrator password. After doing that, we cannot
connect from our computers (Windows XP SP2) to any of our SQL servers
(1 Windows Server 2000, 3 Windows Server 2003). We see the following
error:
A connection could not be established to "servername"
Reason: Cannot generate SSPI context.
Please verify that SQL Server is running and check your SQL Server
registration properties and try again.
Any Ideas?
Could be an issue with your SPN - you can find more info and
troubleshooting steps for the error in the following
article:
How to troubleshoot the "Cannot generate SSPI context" error
message
http://support.microsoft.com/?id=811889
-Sue
On 17 Jan 2006 05:43:12 -0800, "jgrubbs@.pgsd.org"
<jgrubbs@.pgsd.org> wrote:

>We have 4 instances of SQL running on 4 different servers. We recently
>had to change our administrator password. After doing that, we cannot
>connect from our computers (Windows XP SP2) to any of our SQL servers
>(1 Windows Server 2000, 3 Windows Server 2003). We see the following
>error:
>A connection could not be established to "servername"
>Reason: Cannot generate SSPI context.
>Please verify that SQL Server is running and check your SQL Server
>registration properties and try again.
>Any Ideas?
|||Thanks, we figured out the issue. The SQLSERVER and the SQLSERVERAGENT
service were set to use the old password. Once we changed this, we
were able to connect.

After password change, cannot connect to SQL servers.

We have 4 instances of SQL running on 4 different servers. We recently
had to change our administrator password. After doing that, we cannot
connect from our computers (Windows XP SP2) to any of our SQL servers
(1 Windows Server 2000, 3 Windows Server 2003). We see the following
error:
A connection could not be established to "servername"
Reason: Cannot generate SSPI context.
Please verify that SQL Server is running and check your SQL Server
registration properties and try again.
Any Ideas?Check this article and see if it helps.
http://support.microsoft.com/default.aspx?scid=kb;en-us;811889
VM
"jgrubbs@.pgsd.org" wrote:
> We have 4 instances of SQL running on 4 different servers. We recently
> had to change our administrator password. After doing that, we cannot
> connect from our computers (Windows XP SP2) to any of our SQL servers
> (1 Windows Server 2000, 3 Windows Server 2003). We see the following
> error:
> A connection could not be established to "servername"
> Reason: Cannot generate SSPI context.
> Please verify that SQL Server is running and check your SQL Server
> registration properties and try again.
> Any Ideas?
>

After password change, cannot connect to SQL servers.

We have 4 instances of SQL running on 4 different servers. We recently
had to change our administrator password. After doing that, we cannot
connect from our computers (Windows XP SP2) to any of our SQL servers
(1 Windows Server 2000, 3 Windows Server 2003). We see the following
error:
A connection could not be established to "servername"
Reason: Cannot generate SSPI context.
Please verify that SQL Server is running and check your SQL Server
registration properties and try again.
Any Ideas?Check this article and see if it helps.
http://support.microsoft.com/defaul...kb;en-us;811889
VM
"jgrubbs@.pgsd.org" wrote:

> We have 4 instances of SQL running on 4 different servers. We recently
> had to change our administrator password. After doing that, we cannot
> connect from our computers (Windows XP SP2) to any of our SQL servers
> (1 Windows Server 2000, 3 Windows Server 2003). We see the following
> error:
> A connection could not be established to "servername"
> Reason: Cannot generate SSPI context.
> Please verify that SQL Server is running and check your SQL Server
> registration properties and try again.
> Any Ideas?
>

After Install sql 2005 by default

Is sql2005 sercurity logins and password case-sensitive? I installed by
default nothing special and no select any case sensitive box.
Thanks
If the collation selected during installation is the default
Latin1_General_CI_AS (Case insensitive, Accent Sensitive), the login name
should be case insensitive, but the password will be always sensitive.
Gilberto Zampatti
"mecn" wrote:

> Is sql2005 sercurity logins and password case-sensitive? I installed by
> default nothing special and no select any case sensitive box.
> Thanks
>
>

After Install sql 2005 by default

Is sql2005 sercurity logins and password case-sensitive? I installed by
default nothing special and no select any case sensitive box.
ThanksIf the collation selected during installation is the default
Latin1_General_CI_AS (Case insensitive, Accent Sensitive), the login name
should be case insensitive, but the password will be always sensitive.
Gilberto Zampatti
"mecn" wrote:
> Is sql2005 sercurity logins and password case-sensitive? I installed by
> default nothing special and no select any case sensitive box.
> Thanks
>
>

After Install sql 2005 by default

Is sql2005 sercurity logins and password case-sensitive? I installed by
default nothing special and no select any case sensitive box.
ThanksIf the collation selected during installation is the default
Latin1_General_CI_AS (Case insensitive, Accent Sensitive), the login name
should be case insensitive, but the password will be always sensitive.
Gilberto Zampatti
"mecn" wrote:

> Is sql2005 sercurity logins and password case-sensitive? I installed by
> default nothing special and no select any case sensitive box.
> Thanks
>
>