Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top
  • We use squid as a HTTP proxy (if needed I can modify it's configuration).
  • We want to access a website that uses ntlm for authentication
  • When we go on the website through squid we see a blank page
  • When we go the website through a DSL box, we see an authentication popup (desired result)

I don't know much about NTLM ... deranged imagination ... crappy protolol ... grmbl grmbl :D :D :D

This thread says it can't be done :

Are there any guru who can provide a solution or a workaround?

Here's telnet output on port 80 for the desired website :

Trying 111.222.333.444...
Connected to (111.222.333.444).
Escape character is '^]'.
GET /index.htm HTTP/1.1

HTTP/1.1 401 Unauthorized
Server: Microsoft-IIS/7.5
SPRequestGuid: 2764478a-b14a-4541-9110-27ebf4281e84
WWW-Authenticate: NTLM
X-Powered-By: ASP.NET
Date: Mon, 25 Nov 2013 14:25:26 GMT

Bonus : We use 2 chained proxy (squid-2.6 rhel5) servers

Edit : Using NTLM to do squid authentication is not what we are trying to achieve.

Edit 2 : The website we try to reach is outside our company, outside of our network. In fact it is a public website with a public IP. If I exclude this website from proxy configuration, it won't work because our workstation have no route to the internet nor direct connection.

share|improve this question
It seems this website covers how to use ntlm for squid authentication and this is not my question at all. – user130370 Dec 5 '13 at 10:41
I contacted the website administrator and they are digging the problem on their side too. – user130370 Dec 16 '13 at 8:36

NTLM is connection orientated and since there's no direct connection between you and the webserver when you use the proxy, so NTLM fails. (There's a connection between you and the proxy and a second connection between the proxy and the website.)

If you can't upgrade to for example Kerberos auth your best bet is to add the webserver to the proxy exclude list in your client configuration (PAC file?). Typically internal servers on the corporate intranet (which is where you'd expect NTLM auth) are excluded from the proxy for this reason and clients connect directly.


Apparently there's an option in Squid for NTLM passthough authentication: Connection Pinning. Available from Squid version 2.6 and up and 3.1 and up.

http_port ... connection-auth[=on|off]
https_port ... connection-auth[=on|off]
share|improve this answer
This, you need a TCP proxy to get NTLM over a proxy. – GomoX Dec 5 '13 at 12:53
I can't upgrade to kerberos since the website we have to use is not our website, nor it is part of our company. – user130370 Dec 5 '13 at 13:52
Gave more details about the problem inside the question – user130370 Dec 5 '13 at 13:55
Added the info on NTLM passthough authentication support in Squid 2.6/3.1 and up to my earlier answer. – HBruijn Dec 5 '13 at 14:49
Looks like exactly what the OP needed. – GomoX Dec 5 '13 at 14:50

Based on the information provided, I don't think you can create a workaround to use NTLM over Squid over the Internet without going "outside the box" somehow.

A possible suggestion would be using HAproxy (which does TCP reverse proxying) to create a local URL in your network that pipes requests to the site on the other end. If you have to go through 2 different hops (i.e the 2 machines running Squid) then you would have to set up two instances.

Configuration would be something on the lines of:

listen localsite
    mode tcp
    balance roundrobin
    option  tcplog

    server upstream1

While you do have to run a separate application, HAproxy is super painless (install a single package, 10 line config file, pretty much 0 configuration, 0 maintenance).

The other option would be to modify the system's configuration to enable some sort of SSO, and then use a local NTLM authenticator to initiate the sessions to the upstream system. This might imply development and changes to the system.

I don't think I have ever seen NTLM used over the Internet though, it's generally used in LANs. Maybe if you expand on the situation we can suggest an alternative strategy.

share|improve this answer
NTLM is used all the time for Exchange (Outlook Anywhere - RPC over HTTPS). – mfinni Dec 5 '13 at 14:13
I had no idea :) – GomoX Dec 5 '13 at 14:35
+1 for the idea of using an alternate proxy – user130370 Dec 9 '13 at 12:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.