所以我需要通过 Windows 身份验证从 Unix 服务器连接到 mssql 服务器。以下是障碍：
-
数据库管理员创建了一个服务帐户，但仅将其设置为 Windows 身份验证，这意味着我无法将用户名和密码直接传递到服务器进行连接。
-
管理员还将我的主机的服务器添加到防火墙，以便它只接受来自我的主机的请求。
管理员还将我的
-
我的主机服务器已通过 freetds/sybase-dblib 启用了 mssql，但仍设置了默认的“安全连接：关闭”。
-
我在我的个人计算机上有类似的设置，但启用了安全连接，但我无法以这种方式连接，因为我有防火墙。
所以我想知道是否可以在我的主机上设置某种代理，以便我可以使用本地 freeTDS 库在我的个人计算机上启动连接，但将请求传递到主机（在我的梦想世界中） ）不需要打开安全连接，但只需传递请求，以便它来自我的非防火墙主机，但使用正确的身份验证方法。
如果有人不熟悉 Windows 身份验证的工作原理，它是一种 Kerberos 身份验证，客户端计算机向远程服务器发出请求，以便凭证永远不会真正发送（因此不会被人为破坏）中间）。所以我非常怀疑这是否可以完成，因为在某种程度上我的主机必须完成实际的工作。但我想我会问，因为我对更深层次的机制并不完全清楚，而且我真的想让这一切发生。
我想另一种看待它的方式是我想使用我的主机作为一种 VPN。
另外，我正在与我的主机管理员合作寻找更长期的解决方案，但我需要尽快查看数据库，以便在问题解决后我可以有一些工作。
So I need to connect to a mssql server via Windows Authentication from a Unix server. Here are the obstacles:
-
The db admin created a service account but made it Windows-Auth only, meaning I can't pass the username and password directly to the server to connect.
-
The admin also added my host's server to the firewall so that it would only accept requests from my host machine.
-
My host server has mssql enabled via freetds/sybase-dblib, but has the default 'secure-connections: Off' still set.
-
I have a similar set up on my personal machine, but with secure-connections on, but I can't connect that way since I'm firewalled.
So I'm wondering if it's possible to set up a proxy of sorts on my host so that I can start the connection on my personal machine using my local freeTDS library, but have the request pass to the host which would (in my dream world) not require secure connections to be on but simply would pass the request along so that it came from my non-firewalled host but using the correct authentication method.
If anyone is not familiar with how Windows-Authentication works, it's a type of Kerberos authentication where the client machine makes the request to the remote server so that credentials are never actually sent (and thus can't be compromised by a man-in-the-middle). So I'm very doubtful that this can be done, since at some level my host machine has to do the actual work. But i thought I'd ask since I'm not totally clear on the deeper mechanics and because I really want to get this to happen.
I guess another way of looking at it is I want to use my host as a kind of VPN.
Also, I am working with my host admins to find a more long-term solution but I need to see the database as soon as possible so I can have something working when the problem gets fixed.
发布评论
评论（1）
为什么不尝试 SSH 端口转发呢？ IE。您连接到主机服务器，并告诉它将本地端口转发到 sql 服务器。然后，您使用 localhost:port 连接到本地计算机，并且您的连接将通过主机服务器通过 ssh 进行隧道传输。
如果您的本地计算机是 Windows 计算机，则只需下载 PuTTY 并按照以下说明设置端口转发：http://www.cs.uu.nl/technical/services/ssh/putty/puttyfw.html。
当然，问题是您的 Windows 凭据是否会通过，但理论上这应该可行:p。
Why don't you try SSH port forwarding? Ie. you connect to your host server, and tell it to forward a local port to the sql server. Then you connect on your local machine using localhost:port and your connection will be tunneled over ssh through your host server.
If your local machine is a Windows machine then just download PuTTY and follow these instructions to set up port forwarding : http://www.cs.uu.nl/technical/services/ssh/putty/puttyfw.html.
The question is of course whether your Windows credentials will be passed, but in theory this should work :p.