SSL provides several levels of security in Open Client and Open Server:
When establishing a connection to an SSL-enabled server, the server authenticates itself—proves that it is the server you intended to contact—and an encrypted SSL session begins before any data is transmitted.
Once the SSL session is established, user name and password are transmitted over a secure, encrypted connection.
A comparison of the server certificate’s digital signature can determine if any information received from the server was modified in transit.
When establishing a connection to an SSL-enabled Adaptive Server, the SSL security mechanism is specified as a filter on the master and query lines in the interfaces file (sql.ini on Windows). SSL is used as an Open Client and Open Server protocol layer that sits on top of the TCP/IP connection.
The SSL filter is different from other security mechanisms, such as DCE and Kerberos, which are defined with SECHMECH (security mechanism) lines in the interfaces file (sql.ini on Windows). The master and query lines determine the security protocols that are enforced for the connection.
For example, a typical interfaces file on a UNIX machine using transport layer interface (tli) and SSL looks like this:
SERVER <retries><time-outs>
query tli tcp /dev/tcp
tli_add1 ssl
master tli tcp /dev/tcp tli_add1
ssl
A typical sql.ini file on Windows NT using SSL looks like this:
[SERVER]
query=TCP,hostname,address1, ssl
master=TCP,hostname,address1, ssl
where hostname is the name of the server to which the client is connecting, and address1 is the port number of the host machine. All connection attempts to a master or query entry in the interfaces file with an SSL filter must support the SSL protocol. A server can be configured to accept SSL connections and have other connections that accept plain text (unencrypted data), or use other security mechanisms.
For example, an Adaptive Server interfaces file on UNIX that supports both SSL-based connections and plain-text connections looks like this:
SYBSRV1
master tli tcp /dev/tcp \x00020abc123456780000000000000000 ssl
query tli tcp /dev/tcp \x00020abc123456780000000000000000 ssl
master tli tcp /dev/tcp \x00020abd123456780000000000000000
Or, the same entry with the new style of Sybase interfaces file on UNIX looks like this:
SYBSRV1
master tli tcp hostname 2748 ssl
query tli tcp hostname 2748 ssl
master tli tcp hostname 2749
An example of a socket-style interfaces file looks like:
SYBSRV1
master tcp ether hostname 2748 ssl
query tcp ether hostname 2748 ssl
master tcp ether hostname 2749
In these examples, the SSL security service is specified on port number 2748(0x0abc). On SYBSRV1, Adaptive Server listens for clear text on port number 2749(0x0abd), which is without any security mechanism or security filter.
