[cvsnt] sspi authentication bug?

[Glen Starrett]

jon lennard wrote:

>The guest account is disabled.  I am new to the SSPI protocol -
>I just heard of it today.  Since this is a Microsoft proprietary
>protocol is there any way it is authenticating off of the
>VPN account?  I wouldn't think this is possible but
>with M$ you never know.
>
>  
>
Agreed.  I'd say it depends on the type of VPN, and I don't know enough 
about them to help you further down that path.  Suffice to say that if 
you can do a "net view" against the server, then SSPI can connect and be 
authenticated.  SSPI asks Windows to handle the authentication, so as 
long as Win can work out some method it'll work.

Another possibility is if you've established a session with that server 
through some file share or similar.  If you're communicating with the 
server with a method that requires authentication (with some exceptions) 
then you already have your credentials established and that's probably 
what SSPI is using.

I'm curious as to the outcome.  If there is a bug I certainly want to 
know about it.  Please keep us informed.

Regards,

-- 
Glen Starrett

--(shameless plug)--
Help Scotty get his star: http://www.ScottysStar.com/