Thread Info
  • State Suggested Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 30 replies
  • Answers 3 answers
  • Subscribers 3 subscribers
  • Views 68930 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Has anybody managed to successfully deploy Sophos Enterprise 5.5.1 while using the TLS1.2 database connectivity?

Redfern

I just cant seem to figure it out how to get it to work...? even though Im on server2012 R2 fully updated, with SQL 2012 SP4. No matter what i do the Sophos Installer always says:

 

(x) SQL Server instance does not support TLS 1.2

(x) There is no certificate installed that can be used with SQL Server

I ignored these warnings and Installed SEC5.5.1 anyway as it still works with TLS1.0, but i relly want it to work with TLS1.2, Anybody else have any similar issues?

 

Cheers



This thread was automatically locked due to age.
Parents
  • 0

    Hello Redfern,

    I am in the process of updating from 5.4.1 and have outcome all but the stated instance support error. I too am on 2012 SP4 /w CU 10. I've tried many different things after ensuring it was not anything to do with an encrypted connection to the SQL server.

    So I decided to log a ticket with Sophos to get their explanation on the issue. I'm wondering if it is simply checking for a version number that is different, below mine is stated as 11.4.7001.0 which might identify express version over other versions.

     SQL Server 2012
         codename Denali    		 11.0.2100.60 11.0.3000.0
    or 11.1.3000.0    		 11.0.5058.0
    or 11.2.5058.0    		 11.0.6020.0
    or 11.3.6020.0    		 11.0.7001.0
    or 11.4.7001.0

    In your case the cert issue is that you will need to configure a certificate for use with the SQL Server. We have an enterprise CA so it's quite straightforward for me (just remember to configure all the alternate names you might be using). Sophos link below if you haven't already seen it.

    community.sophos.com/.../127521


    Can let you know what they reply.

    Cheers,

    Grant

  • 0 in reply to Grant Joslin

    Hi Grant. 

    Thanks for this. 

    Did you get a helpful Reply? 

     

    Would be grateful if you can share it with us. 

     

    Cheers. 

     

    Shahid 

  • 0 in reply to Grant Joslin

    Have you run the CheckDBconnection.exe -a to setup the SQLNLI connection string

    The tool has two working mode. The default is checking the system for TLS 1.2 compatibility (system check mode). The second performs the database settings modification (apply mode: -a).

     

  • +1 in reply to Dominic Lisi

    Hi Dominic,

    Where have you been all this time! No I did not see that a tool called CheckDBconnection.exe is used to change the SQL provider. I've just gone back to check that article and can now see that they have it in the guts of the tool info.

    Looks like a real silly place to put it to me as I missed it entirely. Not sure why it is in a list of a parameters for an article called DB connection check. Not sure why there is nothing in the setup to tell you that you need to convert the connection string, or even clear steps in that article outlining;

    1. upgrade

    2. db check

    3. convert connection string

    Thank you, you've saved me a lot of grief as I knew it had to be that, now that I realise this tool is not to check, but to change the SQL connection string I will go back and do exactly that.

    And just like that, I've disabled TLS 1.0 & 1.1 after changing the connection string and everything works as expected.

    Really not a fan of that documentation. 

    Many thanks again!!!

    Grant

  • 0 in reply to Grant Joslin

    Hello

    There have been many mentions to many articles.  When you write "that article", I am not sure which one you refer to ...

    Paul Jr

  • 0 in reply to Big_Buck

    Hi Paul,

    This is one below the main culprit for me, as I'm never one to read details parameters of application unless I think I need the functionality. I really did not expect that the convert string would be found in a db check tool.

    -----------------------------------------
    Article ID: 127521
    Title: Enterprise Console - Database connection check
    URL: https://sophos.com/kb/127521 
    -----------------------------------------

    Anyway, time to continue, I've spent way too much time on this already and life's too short.

    Big thanks again to Dominic for showing me what I had missed.

    Best wishes to all,

    Grant

  • 0 in reply to Grant Joslin

    No problem Grant,

    Agree the single line in the document is not particularly obvious or that it is required to run the connectivity tool in -a mode to migrate the console over to TLS 1.2

    Surely going forward the functionality will be built into the Installer/Console itself, and would be the recommended default on install. 

     

  • 0 in reply to Grant Joslin

    I have tried that tools many times.  It does just nothing.  The -a switch does nothing more ...

    Not sure I get it ...

    Paul Jr

  • 0 in reply to Big_Buck

    Hi Paul,

    The goal of the tool is to merely convert the sql connection string used by the Sophos app to a SQL client library that supports TLS 1.2. I kept the output of the process which I'll paste below, and yours should look similar. Double check against mine below.

    C:\sourceRepository\Sophos\Sophos Enterprise Console\sec_551\ServerInstaller\CheckDBConnection>CheckDBconnection.exe -a -c -l
    Sophos Connectivity Verifier
    5.5.1.955

    Copyright 2000-2018 Sophos Limited. All rights reserved.
    Sophos and Sophos Anti-Virus are registered trademarks of Sophos Limited and Sop
    hos Group. All other product and company names mentioned are trademarks or regis
    tered trademarks of their respective owners.

    UpdateConnectionString 64 bit system
    UpdateConnectionString :
    Registry Key: Software\Wow6432Node\Sophos\EE\Management Tools
    Value: DatabaseConnectionMS
    Trust cert: True

    Found: Provider=SQLOLEDB;Integrated Security=SSPI;Initial Catalog=SOPHOS551;Data Source=(hostname)\SOPHOS;

    Testing: Provider=SQLNCLI11;Trusted_Connection=Yes;Database=SOPHOS551;Server=(hostname)\SOPHOS;Encrypt=yes;TrustServerCertificate=true;

    TestDatabaseConnectionWithConnectionString 'Provider=SQLNCLI11;Trusted_Connection=Yes;Database=SOPHOS551;Server=(hostname)\SOPHOS;Encrypt=yes;TrustServerCertificate=true;'

    NewConnStr 'Trusted_Connection=Yes;Database=SOPHOS551;(hostname)\SOPHOS;Encrypt=yes;TrustServerCertificate=true;;'

    Test successfull, writing reg key
    UpdateConnectionString :
    Registry Key: Software\Sophos\ServerSecurity
    Value: DatabaseConnection
    Trust cert: True

    Found: Integrated Security=SSPI;Initial Catalog=SophosSecurity;Data Source=(local)\SOPHOS;

    Testing: Provider=SQLNCLI11; Trusted_Connection=Yes;Database=SophosSecurity;Server=(hostname)\SOPHOS;Encrypt=yes;TrustServerCertificate=true;

    TestDatabaseConnectionWithConnectionString 'Provider=SQLNCLI11; Trusted_Connection=Yes;Database=SophosSecurity;(hostname)\SOPHOS;Encrypt=yes;TrustServerCertificate=true;'

    NewConnStr ' Trusted_Connection=Yes;Database=SophosSecurity;(hostname)\SOPHOS;Encrypt=yes;TrustServerCertificate=true;;'

    Test successfull, writing reg key
    UpdateConnectionString :
    Registry Key: Software\Wow6432Node\Sophos\ServerSecurity
    Value: DatabaseConnection
    Trust cert: True

    Found: Integrated Security=SSPI;Initial Catalog=SophosSecurity;Data Source=(local)\SOPHOS;

    Testing: Provider=SQLNCLI11; Trusted_Connection=Yes;Database=SophosSecurity;Server=(hostname)SOPHOS;Encrypt=yes;TrustServerCertificate=true;

    TestDatabaseConnectionWithConnectionString 'Provider=SQLNCLI11; Trusted_Connection=Yes;Database=SophosSecurity;Server=(hostname)\SOPHOS;Encrypt=yes;TrustServerCertificate=true;'

    NewConnStr ' Trusted_Connection=Yes;Database=SophosSecurity;Server=(hostname)\SOPHOS;Encrypt=yes;TrustServerCertificate=true;;'

    Test successfull, writing reg key
    UpdateConnectionString :
    Registry Key: Software\Sophos\Patch
    Value: SophosPatchConnectionString
    Trust cert: True

    Found: Data Source=(local)\SOPHOS;Initial Catalog=SOPHOSPATCH52;Integrated Security=SSPI;Connect Timeout=60

    Testing: Provider=SQLNCLI11; Server=(hostname)\SOPHOS;Database=SOPHOSPATCH52;Trusted_Connection=Yes;Timeout=60;Encrypt=yes;TrustServerCertificate=true;

    TestDatabaseConnectionWithConnectionString 'Provider=SQLNCLI11; Server=(hostname)\SOPHOS;Database=SOPHOSPATCH52;Trusted_Connection=Yes;Timeout=60;Encrypt=yes;TrustServerCertificate=true;'

    NewConnStr ' Server=(hostname)\SOPHOS;Database=SOPHOSPATCH52;Trusted_Connection=Yes;Timeout=60;Encrypt=yes;TrustServerCertificate=true;;'

    Test successfull, writing reg key
    Database connection settings modified successfully

     

    best wishes,

    Grant

  • 0 in reply to Grant Joslin

    Hello

    I get the exact same output as you with the command "CheckDBconnection.exe -a -c -l".  But running C:\sec_551\ServerInstaller\CheckDBConnection\CheckDBConnection.exe without switches afterward, you get this:

    C:\sec_551\ServerInstaller\CheckDBConnection>CheckDBConnection.exe
    Sophos Connectivity Verifier
    5.5.1.955

    Copyright 2000-2018 Sophos Limited. All rights reserved.
    Sophos and Sophos Anti-Virus are registered trademarks of Sophos Limited and Sophos Group. All other product and company names mentioned are trademark
    s or registered trademarks of their respective owners.

    (/) Operating system is ready to use TLS 1.2
    (/) Installed .NET Framework supports TLS 1.2
    Connection to the SQL Server established
    (x) SQL Server instance does not support TLS 1.2
    (x) SQL Server TCP/IP protocol detection failed
    (/) There is a certificate installed that can be used with SQL Server
    (/) SQL Server Native Client library supports TLS 1.2
    Encrypted connection to the SQL Server cannot be established

    C:\sec_551\ServerInstaller\CheckDBConnection>

    My version of SQL clearly support TLS 1.2.  And TCP/IP is clearly enabled.

    Paul Jr Robitaille

  • 0 in reply to Big_Buck

    My version of SQl is: 

    Product Version: 11.0.7469.6
    Product Name: SQL Server 2012
    Product Level: SP4
    Product Edition: Express Edition (64-bit)

    Which clearly supports TLS1.2

    Paul Jr

  • 0 in reply to Big_Buck

    Hi Paul,

    I'd probably start with SQL Server configuration manager and make sure that the TCP/IP connections are accepted.

    Grant

Reply Children
No Data
Unfiltered HTML