Message signature for NTLMv2 Authentication message

Hi,
I'm implementing NTLMv2 support for SMBv2 and I have encountered some problems calculating the correct checksum for the authentication message.
Authentication packet:
4E 54 4C 4D 53 53 50 00 03 00 00 00 18 00 18 00 AE 00 00 00 42 01 42 01 C6 00 00 00 1E 00 1E 00 58 00 00 00 1A 00 1A 00 76 00 00 00 1E 00 1E 00 90 00 00 00 10 00 10 00 08 02 00 00 15 82 88 E2 06 01 B1 1D 00 00 00 0F 57 7C 17 17 5E DF 25 D8 8C 06 8D E6 75 5F
62 65 57 00 49 00 4E 00 2D 00 34 00 37 00 50 00 30 00 39 00 4E 00 51 00 42 00 4B 00 49 00 38 00 41 00 64 00 6D 00 69 00 6E 00 69 00 73 00 74 00 72 00 61 00 74 00 6F 00 72 00 57 00 49 00 4E 00 2D 00 51 00 32 00 33 00 49 00 36 00 4F 00 34 00 55 00 55 00 44 00
53 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 67 E7 1D 8A 39 CC A0 52 A7 01 51 02 E9 5A DF 7B 01 01 00 00 00 00 00 00 7F D2 02 FD 80 6C D0 01 2A 01 01 16 D7 E9 11 F7 00 00 00 00 02 00 1E 00 57 00 49 00 4E 00 2D 00 34 00 37 00
50 00 30 00 39 00 4E 00 51 00 42 00 4B 00 49 00 38 00 01 00 1E 00 57 00 49 00 4E 00 2D 00 34 00 37 00 50 00 30 00 39 00 4E 00 51 00 42 00 4B 00 49 00 38 00 04 00 1E 00 57 00 49 00 4E 00 2D 00 34 00 37 00 50 00 30 00 39 00 4E 00 51 00 42 00 4B 00 49 00 38 00
03 00 1E 00 57 00 49 00 4E 00 2D 00 34 00 37 00 50 00 30 00 39 00 4E 00 51 00 42 00 4B 00 49 00 38 00 07 00 08 00 7F D2 02 FD 80 6C D0 01 06 00 04 00 02 00 00 00 08 00 30 00 30 00 00 00 00 00 00 00 00 00 00 00 00 30 00 00 20 28 45 5A F8 71 0C F9 CC 5A EB A1
F5 FB C3 17 49 CE 76 FF 1B 32 31 4D 52 E7 0E D8 B0 BA C5 F9 0A 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 00 22 00 63 00 69 00 66 00 73 00 2F 00 31 00 39 00 32 00 2E 00 31 00 36 00 38 00 2E 00 31 00 2E 00 31 00 31 00 00 00 00 00 00 00 00 00
00 00 00 00 03 AC 9B EA 78 DD DF 49 BB D8 2D 66 0C 4F 22 61
By offline testing of packets I was able to get
ExportedSessionKey: 945d257f88b6be1a4b201748e3f134c5
and from there calculate the correct MIC (based on the negotiation,challenge and authentication messages).
But now when I am trying to calculate the checksum for the message signature I can't get this right.
The SignKey equals to md5(concat(ExportedSessionKey,"session key to client-to-server signing key magic constant")):
2643d035ac56345368b321df5059f9b0
The SealKey equals to md5(concat(ExportedSessionKey,"session key to client-to-server sealing key magic constant"))
dbb66166a80c4be9b876a6f4ec1dd3a5
and the sequence number is: 0
I'm using this function to calculate the checksum:
rc4(sealKey,hmac_md5(SignKey,concat(Sequence Number,message) ) ) [0 .. 7] = 0790d273a21186ce
That's an incorrect checksum, the real checksum should have been: 524102bf5e86c109 (captured from the packet).
These are the negotiation flags of this session that are set:
NegotiateUnicode,RequestTarget,NegotiateSign,NegotiateNTLM,NegotiateAlwaysSign,NegotiateNTLM2,
NegotiateTargetInfo,NegotiateVersion,Negotiate128,NegotiateKeyExch,Negotiate56
The only thing I wasn't sure about is if I need to calculate the checksum from the message with Z(16) instead of the mic or with the real calculated mic. Nevertheless I don't get the checksum on both ways.
I've also added the packets from the relevant session.
https://www.dropbox.com/s/eepcpmim3rj2zkd/ntlm.cap?dl=0
Thanks in advance!

Hi Guy:
The details for how to calculate a MechListMIC are described in RFC 4178 (http://www.rfc-editor.org/rfc/rfc4178.txt) section 5(a).
Any details specific to Windows are described in MS-SPNG (https://msdn.microsoft.com/en-us/library/cc247021.aspx) documents.
I will give you an example here how the client calculates MechListMIC in case of NTLM.
For this example, I used an actual SMB2 session set up exchange. If you need the network trace that I used, please send an email to dochelp at microsoft dot com to my attention referencing this thread.
server challenge: 0x91, 0xA7, 0xB5, 0xA0, 0x93, 0xD1, 0x28, 0x73
Password: Password01!
client's MechTypes from first session set up message : 30 0C 06 0A 2B 06 01 04 01 82 37 02 02 0A
Security blob from the session set up command that contains the authenticate message:
A1 82 01 CD 30 82 01 C9 A0 03 0A 01 01 A2 82 01
AC 04 82 01 A8 4E 54 4C 4D 53 53 50 00 03 00 00
00 18 00 18 00 86 00 00 00 FA 00 FA 00 9E 00 00
00 0C 00 0C 00 58 00 00 00 06 00 06 00 64 00 00
00 1C 00 1C 00 6A 00 00 00 10 00 10 00 98 01 00
00 15 82 88 E2 06 03 80 25 00 00 00 0F 82 C4 C5
F7 7B 08 49 FD A2 87 0E A3 05 EC 77 AB 66 00 6F
00 72 00 4D 00 44 00 4D 00 61 00 62 00 63 00 4D
00 49 00 4E 00 49 00 4E 00 54 00 2D 00 36 00 37
00 31 00 30 00 38 00 46 00 4B 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 30 0B A0 EF 0B 39 38 45 54 E6 ED 4F B4
FD 6D B6 01 01 00 00 00 00 00 00 72 23 6C 58 68
6D D0 01 B5 FF F2 9D 10 1B 35 60 00 00 00 00 02
00 0C 00 46 00 4F 00 52 00 4D 00 44 00 4D 00 01
00 0C 00 46 00 4F 00 52 00 4D 00 44 00 4D 00 04
00 0C 00 66 00 6F 00 72 00 4D 00 44 00 4D 00 03
00 0C 00 66 00 6F 00 72 00 4D 00 44 00 4D 00 07
00 08 00 72 23 6C 58 68 6D D0 01 06 00 04 00 02
00 00 00 08 00 30 00 30 00 00 00 00 00 00 00 01
00 00 00 00 20 00 00 15 7C 95 BD E7 02 DE 3B C9
8D F1 46 91 04 AC 4D 16 61 03 F1 BF 42 77 85 B2
82 B7 83 2E CB 1E 3F 0A 00 10 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 09 00 22 00 63
00 69 00 66 00 73 00 2F 00 31 00 39 00 32 00 2E
00 31 00 36 00 38 00 2E 00 31 00 2E 00 34 00 30
00 00 00 00 00 00 00 00 00 00 00 00 00 8E 07 9F
C9 F1 50 97 65 F3 BD A8 C1 32 8A 52 56 A3 12 04
10 01 00 00 00 3B 1F D5 E0 2D 97 5F 97 00 00 00
00
My calculation are from servers perspective. Everything server needs to verify client's MechListMIC
is in the security blob and what is not in blob is already with the server (password, server challenge and client's MechTypes sent in an earlier message).
The KeyExchangeKey is NTLMv2 session base whose calculation is described in MS-NLMP (https://msdn.microsoft.com/en-us/library/cc236621.aspx) section "3.3.2 NTLM v2 Authentication"
KeyExchangeKey (NTLMv2 session base key)=ad6e6c75872afd2178533d2ebb8ad9ad
Using KeyExchangeKey to RC4 decrypt the Encrypted Random Session key, we get
Random Session Key: c7 9a 31 b6 8d b6 4e 3f 84 66 be a3 b2 22 3b c1
Using Random session key above and description in MS-NLMP, we calculate the signing and sealing keys.
Server Signing Key: 69 cb 53 69 d5 18 75 04 dc 7e 61 03 33 10 53 e9
Server Seal Key: 35 4e c9 d1 86 2d 4f a5 98 25 87 c4 b5 35 f2 33
Client Signing Key: a2 b2 1a ed a9 ec d3 f1 3d ff c3 3d e0 1b 59 30
Client Seal Key: 1e bb c6 f3 65 5b dc 13 b3 5b e4 e2 24 eb 71 e2
Now using the client signing and sealing keys, we proceed to calculate the NTLM signature of client's MechTypes as described in MS-NLMP section "3.4.4.2 With Extended Session Security":
Message number is 00 00 00 00
MechList with 0000 concatenated:
00 00 00 00 30 0c 06 0a 2b 06 01 04 01 82 37 02 02 0a
HMAC_MD5 of the above using client signing key (first 8 bytes): 28 d5 e1 57 a4 d4 58 24
checksum (RC4 encrypting the above using Client Sealing key): 3b 1f d5 e0 2d 97 5f 97
MechListMIC by appending version and sequence: 01 00 00 00 3b 1f d5 e0 2d 97 5f 97 00 00 00 00
As you can see this matches with what client sent.
Please let me know if it does not answer your question.
Regards, Obaid Farooqi

Similar Messages

I have just upgraded to Mountain Lion and my signatures for my Mail is not showing up. I have the signatures inthe preference panes and selected for the email address, but when I make a new message, the signature shows as none and doesn't give me a choice

I have just upgraded to Mountain Lion and my signatures for my Mail are not showing up. I have the signatures inthe preference panes and selected for the email address, but when I make a new message, the signature shows as none and doesn't give me a choice. Yesterday, the signatures were stacking instead of switching to the one I wanted to choose.

I had this and fixed it.
I had upgraded to Mountain Lion and my signatures in Mail were fine. But then about a week later, I got a new computer and used Migration Assistant to copy my stuff to the new machine. Upon opening Mail, I had all the correct Signature information in the Preferences>Signatures window, but nothing worked.
After lots of hunting, I found the Signature Folder. It's in:
Yourusername>Library>Mail>V2>MailData>Signatures
Looking at my previous setup (which works) I saw in that folder two types of files: .webarchive and .siganture
Looking in my new machine's Signature folder, I saw only the .webarchive folders, not the .signature folders
Since this was literally a clone of my previous setup to a new machine, here's what I did:
1. Quit Mail
2. In Problem machine, go to
Yourusername>Library>Mail>V2>MailData>Signatures
3. Move the Signatures folder someplace safe, but out of the MailData folder
4. Get the Signatures Folder from the working install (like a backup) and copy it to the MailData folder on the problematic machine
5. Start Mail on the problem machine
This worked for me. I don't know why Migration Assistant didn't copy the full signature folder, but this fixed it. It worked perfectly partly because I had just backed up with Carbon Copy Cloner and the very next day set up the new machine. I don't know where Lion or earlier versions of mail stored signatures, but the absence of the .signature filetype seems to be the problem.
Hope this helps

HT3529 How do I set a signature for text messages?

How do I set a signature for text messages?

You can set a signature in Mail but not in Messages.

Archive signature for RNIF message

Hello everybody,
We are using RosettaNet (RNIF) adapter on PI 7.1 and we have to archive XML message AND signature for this message to 3rd party system. Archiving has to be done before BPM in PI will finish processing RNIF request. My question:
Is there any possibility to access signature part of RNIF MIME message from PI so i can send it to archiving system? I was trying adapter bean but it seems i have access only to XML message (not to other mime parts).
Does anybody had similar problem? maybe alternative solution (like cloning request before sending it to PI)?
I will appreciate any kind of help
Regards
Lukas

The signature will be applied to all messages you post.
If you have different signatures you'd like to use the best way to set that up is to do different macros.
Hope that helps.
MrMatthew - HP Support Forums Moderator
Click the Kudos star as a way to say "thank you" for helpful posts.
Be sure to come back and click the 'Accept as Solution' button on the post that solved your issue - it may help someone else.

How to make a DKIM signature for outgoing messages in Thunderbird (SMTP-server does not support DKIM)?

SMTP-server does not support DKIM signature.
How to make a DKIM signature for outgoing messages in the Thunderbird?

I'm not familiar with this particular use of the terminology.
Thunderbird has S/MIME support built in. You can add PGP support via the Enigmail add-on. Both offer the means to sign and encrypt messages.
I see add-ons to support the checking of DKIM-signed incoming messages, but haven't found any yet for signing.
Is it something that an email client is entitled to do? The Wikipædia entry says
<blockquote>Both modules, signing and verifying, are usually part of a mail transfer agent (MTA).</blockquote>
and that means a server, as opposed to a client (MUA).

How do u set a signature for text messages

how do u set a signature for ur text mesages

As mentioned, this isn't possible. A (bad) workaround is to write a signature in the notes and copy it to your clipboard by double tapping and using the handles to make a selection and then hitting copy. Then whenever you send a text double tap and hit paste.

Can I make a signature for text messages ?

Can I add a signature for text messages

Only if your carrier supports SMS signatures and you would need to go on their website to create one.

Does iPhone 3g have signatures for text messaging?

Does iPhone 3g have signature for iphone 3g and how do you turn it on if it does

Thanks for the info
signature as the ones u put in the e-mail, as ur name and other info or whatever u want?

Bad PGP/GPG signatures for all Win32 Mozilla firefox partial.mar files

I checked the .asc signature for the Mozilla 12.0 update firefox-11.0-12.0.partial.mar and came up with:
Signature made Fri, Apr 20, 2012 21:24:01 EDT using DSA key ID C52175E2
BAD signature from "Mozilla Software Releases <[email protected]>"
The MD5, SHA1 and SHA512 checksums come back OK.

An interesting interpretation of the facts...
Cygwin, an OpenSource project of Red Hat Inc., (available at http://cygwin.com) is:
• a collection of tools which provide a Linux look and feel environment for Windows.
• a DLL (cygwin1.dll) which acts as a Linux API layer providing substantial Linux API functionality.
Now, using these tools, specifically the ''rsync'' tool (which uses the rsync TCP/IP protocol), I downloaded the update MAR file from the OFFICIAL site using the Rsync address:
rsync://releases-rsync.mozilla.org::mozilla-releases/firefox/releases/12.0/update/win32/en-US/firefox*.mar*
(This is equivalent to: http://releases.mozilla.org/pub/mozilla.org/firefox/releases/12.0/update/win32/en-US/)
This retrieved:
firefox-11.0-12.0.partial.mar 
firefox-11.0-12.0.partial.mar.asc 
firefox-12.0.complete.mar 
firefox-12.0.complete.mar.asc 
The '''''.asc''''' extension is short for ASCII (alternatively, this could be, by convention, '''''.sig''''',) and contains the digital signature generated using the "Mozilla Software Releases" PGP'/GPG key, DSA key ID C52175E2. '''''PGP'''''/'''''GPG''''' are authentication tools that use the RSA encryption algorithm to generate digital signatures that guarantee the veracity of a file or message. The signature for firefox-11.0-12.0.partial.mar does NOT verify. The output of GPG is:
+ gpg --verify firefox-11.0-12.0.partial.mar.asc firefox-11.0-12.0.partial.mar 
... 
gpg: Signature made Fri, Apr 20, 2012 21:24:01 EDT using DSA key ID C52175E2 
gpg: BAD signature from "Mozilla Software Releases " 
Official MD5, SHA1 and SHA512 checksums are also available for this file and its signature. They DO verify properly. For example:
+ md5sum -c .md5sum (.md5sum is extracted from MD5SUMS) 
... 
update/win32/en-US/firefox-12.0.complete.mar: OK 
update/win32/en-US/firefox-12.0.complete.mar.asc: OK 
update/win32/en-US/firefox-11.0-12.0.partial.mar: OK 
update/win32/en-US/firefox-11.0-12.0.partial.mar.asc: OK 
Would someone, please, check why a bad PGP/GPG signature for this file is being distributed? All the Mozilla12.0 partial.mar signatures I've checked (en-{GB,US,ZA}, zh-{CN,TW}) are bad.

Windows cannot verify the digital signature for the drivers required for this device. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. (Code

I get this message when I check the Device manager for my Ipod
Windows cannot verify the digital signature for the drivers required for this device. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. (Code 52)
How do I resolve this I have reinstalled iTunes but it still doesn't recognise my ipod

I reinstalled Itunes a couple of times. I unistalled all programs that I never use, I updated all of my drivers, Windows swept my computer and found no problems. I have a yellow causion lite when I look at the USB-port with the phone connected. All other devices work without a problem.

How to get digital signature for Google Map geocoding V3 in PL/SQL?

Hi, Gurus:
 Could anyone provide me an example about how to generate digital signature for Google Maps service v3 in PL/SQL? We tried to upgrade our program using Google maps service from v2 to v3. We are using PL/SQl on background to send request to Google for geocoding. We found some sample code to register with digital signature, but none of them is based on PL/SQl. Notice I used Google business client ID "gme-XXX" and wallet.
https://developers.google.com/maps/documentation/business/webservices/auth#digital_signatures
Google Maps API - more URL signing samples
Here is my code for V2. I notice in order to get signature, I need to use HMAC-SHA1 algorithm.
procedure Get_Geocoding(P_s_Address in varchar2, P_s_Geocoding out varchar2, P_n_accuracy out number, P_b_success out boolean) is
l_address varchar2(4000);
l_url varchar2(32000);
l_response varchar2(3200);
n_first_comma number;
n_second_comma number;
n_level_length number;
BEGIN
/* TODO implementation required */
l_address:=APEX_UTIL.URL_ENCODE(P_s_Address);
l_address := replace(l_address,' ','+');
l_url := 'http://maps.google.com/maps/geo?q='||l_address||'&'||'output=csv'||'&'||'client=gme-XXX';
l_response := utl_http.request(l_url, APEX_APPLICATION.G_PROXY_SERVER, '/u02/app/oracle/admin/apexsb/wallet', 'XXXXXXXX');
n_level_length:=0;
n_first_comma:=instr(l_response,',',1,1);
n_second_comma:=instr(l_response,',',1,2);
n_level_length:=n_second_comma-n_first_comma-1;
P_n_accuracy:=0;
if n_level_length>0 then
P_n_accuracy:=to_number(substr(l_response,n_first_comma+1, n_level_length));
end if;
l_response:=substr(l_response,instr(l_response,',',1,2)+1);
--dbms_output.put_line('In function: l_response ='||l_response);
P_s_Geocoding:=l_response;
if (P_s_Geocoding<>'0,0') then
P_b_success:=true;
--dbms_output.put_line('true');
else
P_b_success:=false;
--dbms_output.put_line('false');
end if;
END;
Thanks!

Hi, guys:
 I tried to generate digital signature for Google map service
 Maps for Business: Generating Valid Signatures - YouTube
 Generating an HMAC-SHA-1 Signature Using Only PL/SQL
 OAuth and the PL/SQL | Data Warehouse in the Cloud
 but I got error message from Google:
Unable to authenticate the request. Provided 'signature' is not valid for the provided client ID. Learn more: https://developers.google.com/maps/documentation/business/webservices/auth
 I think there is something wrong with my code to generate signature, as if I remove the part regarding client and signature, it will work, can anyone help me on this problem?
/*Procedure Get_Geocoding is used to get geocoding with accuracy level for V3 business account, you can find Google map digital signature descrirption from
https://developers.google.com/maps/documentation/business/webservices/auth#digital_signatures
if geocoding is 0,0, procedure returns false to indicate failure of get geocoding*/
procedure Get_Geocoding2(P_s_Address in varchar2, P_s_Geocoding out varchar2, P_n_accuracy out number, P_b_success out boolean) is
--private key for Google business account, this is provided by Google with client name.
l_private_key_src varchar2(200):='xxxxxxxxxxxxxxxxxxx';
l_private_key_b64_alter varchar2(200):= translate(l_private_key_src,'-_','+/');
l_private_key_bin raw(2000);
l_client_name varchar2(100):='gme-xxx';
l_signature_mac raw(2000);
l_signature_b64 varchar2(200);
l_signature_b64_alter_back varchar2(200);
l_Google_service_domain varchar2(200):='http://maps.googleapis.com';
l_address varchar2(4000);
l_url varchar2(32000);
l_path varchar2(32000);
l_response varchar2(32000);
l_page UTL_HTTP.HTML_PIECES;
n_actual_length number;
json_obj json;
json_tempobj json;
jl_listOfValues json_list;
json_geom_obj json;
json_loc json;
l_lat VARCHAR2(40);
l_lng VARCHAR2(40);
l_status VARCHAR2(255);
json_accuracy json;
--temp_string varchar2(10000);
n_first_comma number;
n_second_comma number;
n_level_length number;
BEGIN
/* TODO implementation required */
l_private_key_bin := utl_encode.base64_decode(UTL_I18N.string_to_raw(l_private_key_b64_alter, 'AL32UTF8'));
l_address:=APEX_UTIL.URL_ENCODE(P_s_Address);
--dbms_output.put_line(l_address);
l_address := replace(l_address,' ','+');
l_path := '/maps/api/geocode/json?address='||l_address||'&'||'sensor=true';
dbms_output.put_line(l_path);
l_signature_mac :=DBMS_CRYPTO.mac(UTL_I18N.string_to_raw(l_path, 'AL32UTF8'), DBMS_CRYPTO.hmac_sh1,l_private_key_bin);
l_signature_b64:= UTL_RAW.cast_to_varchar2(UTL_ENCODE.base64_encode(l_signature_mac));
l_signature_b64_alter_back:=translate(l_signature_b64,'+/','-_');
dbms_output.put_line(l_signature_b64_alter_back);
--get response from Google map service
l_url:=l_Google_service_domain||l_path||'&client='||l_client_name||'&signature='||l_signature_b64_alter_back;
--l_url:=l_Google_service_domain||l_path;
dbms_output.put_line(l_url);
l_page:=utl_http.request_pieces( l_url, 99999);
for i in 1..l_page.count loop
l_response:=l_response||l_page(i);
end loop;
n_actual_length:=length(l_response);
dbms_output.put_line(n_actual_length);
dbms_output.put_line(l_response);
--parse JSON result
json_obj:=new json(l_response);
l_status := json_ext.get_string(json_obj, 'status');
IF l_status = 'OK' then
jl_listOfValues := json_list(json_obj.get('results'));
json_tempobj := json(jl_listOfValues.get(1));
json_geom_obj := json(json_tempobj.get(3));
json_loc := json_ext.get_json(json_geom_obj, 'location');
l_lat := to_char(json_ext.get_number(json_loc, 'lat'));
l_lng := to_char(json_ext.get_number(json_loc, 'lng'));
P_s_Geocoding:=l_lat||','||l_lng;
dbms_output.put_line('##########'||P_s_Geocoding);
case json_ext.get_string(json_geom_obj, 'location_type')
when 'ROOFTOP' then P_n_accuracy:=9;
when 'RANGE_INTERPOLATED' then P_n_accuracy:=7;
when 'GEOMETRIC_CENTER' then P_n_accuracy:=5;
else P_n_accuracy:=3;
end case;
P_b_success:=true;
else
P_b_success:=false;
P_n_accuracy:=0;
P_s_Geocoding:='0,0';
end if;
END;

Digital Signature for QM Notification

Hi GURUS,
We have ECC 6.0 EHP 4 and want to implement Digital Signature functionality for Quality Notification (Type Q3). When I try to maintain Signature level under "Specify Digital Signature" node in SPRO, system is not allowing me to maintain level (neither header nor task level). It gives a message "Message no. Q0339 -Business operation is not allowed to be initial" Even if I ignore this message and save my entry, when I go back and check entry, entry is not maintained there...........i.e. entry is not saved.
As I am not able to maintain above entry I donu2019t know how to proceed.
Any input from all you SAP GURU will be great help indeed.
Thanks and regards,
Devang

Dear Devang,
Find below the link which might help you.
[digital Signature for QM notification status change;
[Need BADI name for the Digital signature in QM Notification;
Thanks,
Hrishi

802.1x for server authentication

Hello everybody,
this the first time I write on this forum, so please excuse me if I do something wrong.
My objective is to authenticate servers in my customer's server farm, so that none can put an unauthorised server in place.
I am thinking about using 802.1x machine authentication to reach my aim.
Does anybody has experience about similar situations?
The server platforms are:
- Windows 2k Server
- Windows 2k Advanced Server
- Linux Redhat
- IBM AIX
Which are the applicable EAP methods for each platform?
Has anybody experienced the use of 802.1x client such as Meetinghouse or Funk Odissey on the mentioned platforms?
Thank you in advance.
Kind regards,
Barbara

EAP, EAP-TLS, EAP-MS-CHAP v2, and PEAP authentication
The support that 802.1X provides for Extensible Authentication Protocol (EAP) types allows you to choose from several different authentication methods for wireless clients and servers.
EAP
802.1X uses EAP for message exchange during the authentication process. With EAP, an arbitrary authentication method, such as certificates, smart cards, or credentials, is used. EAP allows for an open-ended conversation between an EAP client (such as a wireless computer) and an EAP server (such as an Internet Authentication Service (IAS) server). The conversation consists of requests for authentication information by the server and responses by the client. In order for authentication to be successful, the client and the server must use the same authentication method.
EAP-TLS
EAP-Transport Layer Security (TLS) is an EAP type that is used in certificate-based security environments, and it provides the strongest authentication and key determination method. EAP-TLS provides mutual authentication, negotiation of the encryption method, and encrypted key determination between the client and the authenticating server. If you want to use certificates or smart cards for user and client computer authentication, you must use EAP-TLS or, for enhanced security, Protected EAP (PEAP) with EAP-TLS.
EAP-MS-CHAP v2
EAP-Microsoft Challenge Handshake Authentication Protocol version 2 (MS-CHAP v2) is a mutual authentication method that supports password-based user or computer authentication. During the EAP-MS-CHAP v2 authentication process, both the server and client must prove that they have knowledge of the user's password in order for authentication to succeed. With EAP-MS-CHAP v2, after successful authentication, users can change their passwords, and they are notified when their passwords expire.
EAP-MS-CHAP v2 is available only with PEAP.
PEAP
PEAP is an authentication method that uses TLS to enhance the security of other EAP authentication protocols. PEAP provides the following benefits: an encryption channel to protect EAP methods running within PEAP, dynamic keying material generated from TLS, fast reconnect (the ability to reconnect to a wireless access point by using cached session keys, which allows for quick roaming between wireless access points), and server authentication that can be used to protect against the deployment of unauthorized wireless access points.

Unable to set signature for different accounts

I have a client site where all users have an email address at two different accounts, the same two for all users. All users have a signature setup in Outlook for each email account.
For all users except one, when they select the Inbox for account A and select New Email, they get the signature for account A; and when they select the Inbox for account B and select New Email, they get the signature for account B.
But there is one user who gets the signature for account A no matter whether she creates a new email after selecting the Inbox for account A or account B.
I've looked at her signature setup in Options in Outlook and it's set correctly. She has two signatures and each is assigned to the appropriate account and New messages and Replies/forwards are both set to the appropriate account.
I myself have Outlook setup with multiple accounts and each account has its own signature and when I select any particular Inbox and create a new email, the appropriate signature is added.
Any ideas as to why it keeps defaulting to the signature of one account no matter which Inbox she chooses to create a new email from?
Jonathan

Thanks for your reply. She is using Office 2007. I read what is at the link you provided and unfortunately it wasn't any help.
It says for Outlook 2007 to ensure a signature is set for the default email account. She had a signature set for her original account which is an Exchange one and is the default.
She recently added a second account, which is an IMAP one, and created a signature for it but when she creates an email to be sent out from her new account, the signature in the new email is that of the default account, not the new one, even though Outlook
options is set up correctly so new emails and replies/forwards from the new account are supposed to use its signature.
I tried Outlook in Safe Mode and it was no different.
One other thing is that when she opens the New Mail window there is an Account button right below the Send button. If she changes to the second account, the signature changes and this is how she is sending out email from the second account.
But everyone else in the office does not have to do this. With everyone else, if they first select the Inbox of the second account, then open a New Mail window, the signature is that of the second account. This is how it works on my computer where I have
multiple accounts.
So for some reason it's like Outlook is not detecting that she has selected the Inbox of the second account before opening New Mail. Or else it does detect it and is still defaulting to the primary account. This is what I'm trying to fix.
Jonathan

The driver is not configured for integrated authentication

my code is :
String connectionUrl = "jdbc:sqlserver://169.254.35.45:1486;" +
"databaseName=ipec;"+"integratedSecurity=true";
Connection con = null;
Statement stmt = null;
try
// Establish the connection to the principal server.
Class.forName("com.microsoft.sqlserver.jdbc.SQLServerDriver");
System.out.println("driver loaded");
con = DriverManager.getConnection(conne ctionUrl);
System.out.println("Connected to the principal server.");
but this throws an SQL exception that : Driver is not configured for integrated authentication.
I've placed the sqljdbc_auth.dll in
catalina_root/common/lib where the driver jar file is placed....
but its still givin the same error............
replies are welcomed.............
thank you,
shibhs

shibhs wrote:
but this throws an SQL exception that : Driver is not configured for integrated authentication.
I've placed the sqljdbc_auth.dll in
catalina_root/common/lib where the driver jar file is placed....
but its still givin the same error...........I know this is an old message but I have just had the same problem and it seemed to mean that the driver couldn't find the auth dll. When I put in the windows\system32 directory, the integrated authentication worked fine.
Rgrds
Peter
Edited by: P_Tootill on Jul 3, 2008 3:26 AM

Message signature for NTLMv2 Authentication message

Similar Messages

Maybe you are looking for