9

I must be missing something... I could swear I've done this before but I've torched the VM's that I was using previously.

How do you get apt-get to authenticate through a proxy that only supports NTLM? Do I need to change my proxy config to also support other authentication mechanisms?

Ubuntu 10.04.

3 Answers 3

6

in /etc/apt/apt.conf, add the line:

Acquire::http::Proxy "http://MYDOMAIN\MYNAME:[email protected]:MYPORT";

the semicolon is required at the end of the line to add

5
  • Just checked my servers, and yes, it uses the semicolon. Well spotted sir!
    – Grizly
    Mar 6, 2013 at 6:00
  • 1
    Still, Wireshark is able to decipher Basic Authentication and thus revealing the password as shown above: "MYDOMAIN\MYNAME:[email protected]:MYPORT" In other word, weak Basic HTTP is still revealing passwords. Apr 27, 2016 at 15:34
  • 1
    I really would have thought that was obvious mate.
    – Grizly
    May 12, 2016 at 4:15
  • You'd be amazed how many companies are still using Basic HTTP. May 12, 2016 at 18:23
  • This is not the right solution, this will do Basic authentication only. In this case we need NTLM authentication. Feb 23, 2023 at 10:10
12

A better alternative is to install CNTLM, which is an NTLM proxy that presents itself as an ordinary web proxy.

It's quite easy to install from .deb (trivial dependencies adduser and libc6 which should be on every system ever) and configure. Once you have it installed, you just tell apt-get to use proxy localhost:3128.

This solution has two advantages:

  1. it works for all programs using HTTP/HTTPS/FTP, including apt-get, web browsers, and SSH sessions tunneled over HTTPS (good for escaping the firewall if you need to.)

  2. your password is stored in cntlm.conf as a hash instead of in plain text.

CNTLM works on Windows as well. Very neat.

1
  • This solution worked for me. I installed CNTLM on the Windows host machine and I'm just using it as a relay that doesn't require any authentication. The only drawback with CNTLM is the credentials have to be provided, either in the .ini file or in the command line or prompted during startup. It doesn't use the .pac configuration file from Windows either. In addition, it should be correctly configured to only allow the VM to connect through it and not create a security breach. Feb 23, 2023 at 12:49
1

See Setting up apt-get to use a http-proxy (on https://help.ubuntu.com/community/AptGet/).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .