I posted another thread asking about ntlmaps, but I've given up on that, as I couldn't get it configured, and it seems that even though ntlmaps still seems more popular, it's been obsoleted by cntlm.
Anyway, my company imposed a proxy server which requires NTLM authentication, and as a result, non-NTLM clients don't work. I'm trying now to configure cntlm, but haven't figured out how to configure it for my proxy yet.
Please help me get this configured?
I posted to the cntlm forums, but that place is a ghost town.
Juicy details:
Failing wget (no local proxy in use), for reference:
...so, that's why I'm trying to implement the local proxy to authenticate against this upstream proxy.Code:jamie@mercury:~/garbage/sensitive$ wget --no-check-certificate -d http://www.cnn.com DEBUG output created by Wget 1.11.4 on linux-gnu. --2010-01-26 14:57:02-- http://www.cnn.com/ Resolving www.cnn.com... 157.166.255.18, 157.166.255.19, 157.166.224.25, ... Caching www.cnn.com => 157.166.255.18 157.166.255.19 157.166.224.25 157.166.224.26 157.166.226.25 157.166.226.26 Connecting to www.cnn.com|157.166.255.18|:80... connected. Created socket 3. Releasing 0x09627d08 (new refcount 1). ---request begin--- GET / HTTP/1.0 User-Agent: Wget/1.11.4 Accept: */* Host: www.cnn.com Connection: Keep-Alive ---request end--- HTTP request sent, awaiting response... ---response begin--- HTTP/1.0 307 Proxy Redirect Mime-Version: 1.0 Date: Tue, 26 Jan 2010 13:57:02 CST Content-Type: text/html Cache-Control: no-cache Location: https://zzz-proxy.zzzi.com/B0000D0000N0001/http://www.cnn.com/ Connection: close Content-Length: 1140 ---response end--- 307 Proxy Redirect Location: https://zzz-proxy.zzzi.com/B0000D0000N0001/http://www.cnn.com/ [following] Closed fd 3 --2010-01-26 14:57:03-- https://zzz-proxy.zzzi.com/B0000D0000N0001/http://www.cnn.com/ Resolving zzz-proxy.zzzi.com... 10.XX.XX.XX Caching zzz-proxy.zzzi.com => 10.XX.XX.XX Connecting to zzz-proxy.zzzi.com|10.XX.XX.XX|:443... connected. Created socket 3. Releasing 0x09633568 (new refcount 1). Initiating SSL handshake. Handshake successful; connected socket 3 to SSL handle 0x09633dd0 certificate: subject: /C=US/postalCode=22222/ST=OK/L=Springfield/streetAddress=123 Main St./O=zzz International/OU=zzz CIT/OU=Secure Link SSL Pro/CN=zzz-proxy.zzzi.com issuer: /C=US/O=Network Solutions L.L.C./CN=Network Solutions Certificate Authority WARNING: cannot verify zzz-proxy.zzzi.com's certificate, issued by `/C=US/O=Network Solutions L.L.C./CN=Network Solutions Certificate Authority': Unable to locally verify the issuer's authority. ---request begin--- GET /B0000D0000N0001/http://www.cnn.com/ HTTP/1.0 User-Agent: Wget/1.11.4 Accept: */* Host: zzz-proxy.zzzi.com Connection: Keep-Alive ---request end--- HTTP request sent, awaiting response... ---response begin--- HTTP/1.0 401 Authorization Required Mime-Version: 1.0 Date: Tue, 26 Jan 2010 13:57:03 CST Content-Type: text/html WWW-Authenticate: NTLM WWW-Authenticate: Negotiate Connection: keep-alive Content-Length: 2208 ---response end--- 401 Authorization Required Registered socket 3 for persistent reuse. Skipping 2208 bytes of body: [<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <title>Notification: WWW Authorization Required</title> <style type="text/css"> <!-- body { margin-left: 2%; margin-right: 2%; } p { font-family: verdana, Arial, Helvetica, sans-serif; font-size: 12px; top: 0px; margin-top: 6px; margin-bottom: 6px; } td { font-family: verdana, Arial, Helvetica, sans-serif; font-size: 12px; top: 0px; } .code { font-family: courier; font-size: 12px; top: 0px; } h1 { font-family: verdana, Arial, Helvetica, sans-serif; font-size: 16px; margin-top: 24px; margin-bottom: 8px; } hr { margin-top: 2px; margin-bottom: 2px; } --> </style> </head> <body> <img src="http://www.zzzi.com/images/zzzi-logo.gif" border="0"> <h1>This Page Cannot Be Displayed</h1> <hr> <p> Authentication is required to access the requested web site ( zzz-proxy.zzzi.com ). A valid user ID and password must be entered when prompted. </p> <p> If you have questions, need assistance with your login information, or feel this is an error, please contact zzz International HelpDesk ( <a href="mailto:helpdesk@zzzi.com">helpdesk@zzzi.com</a> ) and provide the codes shown below. </p> <hr> <table> <tr valign="top"> <td valign="top" width="10%">Notification codes: </td> <td valign="top" class="code" width="90%">(1, WWW_AUTH_REQUIRED, zzz-proxy.zzzi.com)</td> </tr> </table> </body> </html> ] done. Authorization failed.
Here's the cntlm config:
And here's the autodetect output (option -M):Code:Code: Proxy zzz-proxy.zzzi.com:443 Listen 3128 Header User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98) Auth NTLM
/var/log/syslog:Code:#note, the following fails the same way, regardless of whether i use "-u myUserId" or "-u domain\myUserID", i just tried the latter on a whim jamie@mercury:~/garbage/sensitive$ cntlm -v -f -I -d zzz-hq -u zzz-hq\myUserId -c ~/garbage/sensitive/cntlm.conf -M http://www.cnn.com cntlm: Proxy listening on 127.0.0.1:3128 cntlm: Resolving proxy zzz-proxy.zzzi.com... Password: Config profile 1/11... Auth request ignored (HTTP code: 0) Config profile 2/11... Auth request ignored (HTTP code: 0) Config profile 3/11... Auth request ignored (HTTP code: 0) Config profile 4/11... Auth request ignored (HTTP code: 0) Config profile 5/11... Auth request ignored (HTTP code: 0) Config profile 6/11... Auth request ignored (HTTP code: 0) Config profile 7/11... Auth request ignored (HTTP code: 0) Config profile 8/11... Auth request ignored (HTTP code: 0) Config profile 9/11... Auth request ignored (HTTP code: 0) Config profile 10/11... Auth request ignored (HTTP code: 0) Config profile 11/11... Auth request ignored (HTTP code: 0) You have used wrong credentials, bad URL or your proxy is quite insane, in which case try submitting a Support Request.
Thanks,Code:Jan 26 14:52:55 mercury cntlm: Starting cntlm version 0.35.1 for LITTLE endian Jan 26 14:52:55 mercury cntlm: Proxy listening on 127.0.0.1:3128 Jan 26 14:52:55 mercury cntlm: Resolving proxy zzz-proxy.zzzi.com... Jan 26 14:52:56 mercury nss_wins[7670]: Workstation name used: mercury Jan 26 14:53:00 mercury nss_wins[7670]: Using proxy 10.XX.XX.XX:443 Jan 26 14:53:02 mercury nss_wins[7670]: Terminating with 0 active threads
Jamie
Adv Reply
Re: Configuring CNTLM to Authenticate Against Corporate Firewall
assword". And this has to happen for all the new GET requests even if the same connection has been authenticated previously.
Re: Configuring CNTLM to Authenticate Against Corporate Firewall
Originally Posted by lazysail
CNTLM 0.92.3 upgraded to support http basic authentication
.
Bookmarks