apt-get through NTLM authenticated proxy

Question

I must be missing something... I could swear I've done this before but I've torched the VM's that I was using previously.

How do you get apt-get to authenticate through a proxy that only supports NTLM? Do I need to change my proxy config to also support other authentication mechanisms?

Ubuntu 10.04.

score 12 · Answer 1 · edited Jan 10 '12 at 07:56

12

A better alternative is to install CNTLM, which is an NTLM proxy that presents itself as an ordinary web proxy.

It's quite easy to install from .deb (trivial dependencies adduser and libc6 which should be on every system ever) and configure. Once you have it installed, you just tell apt-get to use proxy localhost:3128.

This solution has two advantages:

it works for all programs using HTTP/HTTPS/FTP, including apt-get, web browsers, and SSH sessions tunneled over HTTPS (good for escaping the firewall if you need to.)
your password is stored in cntlm.conf as a hash instead of in plain text.

CNTLM works on Windows as well. Very neat.

edited Jan 10 '12 at 07:56

Bart De Vos

17,911
6
63
82

answered Jan 10 '12 at 03:04

Li-aung Yip

423
1
4
9

This solution worked for me. I installed CNTLM on the Windows host machine and I'm just using it as a relay that doesn't require any authentication. The only drawback with CNTLM is the credentials have to be provided, either in the .ini file or in the command line or prompted during startup. It doesn't use the .pac configuration file from Windows either. In addition, it should be correctly configured to only allow the VM to connect through it and not create a security breach. – NicolasBernier Feb 23 '23 at 12:49

score 6 · Accepted Answer · edited Mar 04 '13 at 20:49

6

in /etc/apt/apt.conf, add the line:

Acquire::http::Proxy "http://MYDOMAIN\MYNAME:MYPASS@MY.PROXY.COM:MYPORT";

the semicolon is required at the end of the line to add

edited Mar 04 '13 at 20:49

answered Sep 01 '10 at 07:04

Grizly

2,063
15
21

Just checked my servers, and yes, it uses the semicolon. Well spotted sir! – Grizly Mar 06 '13 at 06:00
1

Still, Wireshark is able to decipher Basic Authentication and thus revealing the password as shown above: "http://MYDOMAIN\MYNAME:MYPASS@MY.PROXY.COM:MYPORT" In other word, weak Basic HTTP is still revealing passwords. – John Greene Apr 27 '16 at 15:34
1

I really would have thought that was obvious mate. – Grizly May 12 '16 at 04:15
You'd be amazed how many companies are still using Basic HTTP. – John Greene May 12 '16 at 18:23
This is not the right solution, this will do Basic authentication only. In this case we need NTLM authentication. – NicolasBernier Feb 23 '23 at 10:10

score 1 · Answer 3 · answered Jun 01 '11 at 22:03

1

See Setting up apt-get to use a http-proxy (on https://help.ubuntu.com/community/AptGet/).

answered Jun 01 '11 at 22:03

Daryl Spitzer

2,996
9
33
40

apt-get through NTLM authenticated proxy

3 Answers3