Language Selection

English French German Italian Portuguese Spanish

kubuntu vs MS ISA Proxy ft apt-get

Recently I had to install an app on Kubuntu through apt but found that I was locked behind a MS ISA Proxy server at work. I read numerous articles and help responses in the forums that suggested adding a line to /etc/apt/apt.conf with the required proxy settings.

I added the regulatory Acquire::http::proxy http://username:password@server and nothing worked. It does not allow the use of the domain name\username combination. Neither does the export environment setting. This poses a bit of a problem if your proxy server is expecting both.

After a wee bit of research (about 20 mins as I get bored following the worldwide tangent and end up on IMDB for an hour before remembering what I was looking for in the first place) I stumbled upon this:

Ensure python is installed first, then

Download the latest version of NTLMAPS from

http://sourceforge.net/projects/ntlmaps/

Yes, I know you can’t connect to the proxy server but if you change konqueror’s proxy settings:

open Konqueror,
SETTINGS
CONFIGURE KONQUEROR
scroll to PROXY
select Manually specify proxy setting - setup

and enter your proxy server settings you will be prompted to enter your username and password and this prompt WILL let you input it with the DOMAIN\USERNAME format.

Extract the contents of the downloaded file into a directory using your preferred extraction tool.

In a shell, or if you are already in one, CD into the directory and use VI or your favourite editor to modify server.cfg

Change:
LISTEN_PORT:5865 --swap for whatever local port you want

PARENT_PROXY_PORT:8080 --swap for your servers port

NT_DOMAIN:pdcl --swap for your domain name

USER:steve --swap for your username

PASSWORD:notgoingtotellyou --swap for your password

Save your changes and exit back to the prompt

Start the server with

pdcl-vaio3:/# python main.py

Open a new shell, keeping the previous one open, and export the following

pdcl-vaio3:/# export http_proxy=http://127.0.0.1:(local LISTEN_PORT that you set in server cfg)

pdcl-vaio3:/# export ftp_proxy=http://127.0.0.1:(local LISTEN_PORT that you set in server cfg)

Then start adept

pdcl-vaio3:/# Kdesu adept-manager

(kdesu if you are not running as root or don't have root access)

I’m fairly confident the same process will work in Ubuntu using synaptic, but either flavour can use apt-get etc in the shell.

* For browsing, open konqueror and change the settings under proxy server to local (127.0.0.1) and the port you set in server.cfg

There you go, Robert is your mother’s brother, updates through your company’s ISA proxy server.

*I recently tried this on openSuse but no matter what the setting, or combination of settings I couldn't get YaST to work on updates.

*It does, however, work on Fedora with yum, you just need to modify yum.conf and add the local proxy setting in there.

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

ntlm and kubuntu7.04

hello ,

I have a problem with kubuntu and apt-get , when i load ./main.py and
tape sudo apt-get update, i have this :

vieurou@vieurou-desktop:~/ntlmaps-0.9.9.0.1$ ./main.py
NTLM authorization Proxy Server v0.9.9.0.1
Copyright (C) 2001-2004 by Dmitry Rozmanov and others.
Now listening at vieurou-desktop on port 8080
Connected from 127.0.0.1:51018
Connected from 127.0.0.1:51019
Connected from 127.0.0.1:51020
Connected from 127.0.0.1:51021
Connected from 127.0.0.1:51022
Connected from 127.0.0.1:51023
Connected from 127.0.0.1:51024
....

but i have not dot (before, with kubuntu 6.10, ntml working good, whith the same server.cfg, some of dot appear..)

this is a copy paste of my server.cfg :

#========================================================================
[GENERAL]

LISTEN_PORT:8080

# If you want APS to authenticate you at WWW servers using NTLM then just leave this
# value blank like PARENT_PROXY: and APS will connect to web servers directly.
# You can specify more than one proxy by leaving a space
between each one, and
# APS will detect when one fails and automatically fail-over to the next. EG:
#PARENT_PROXY:first_proxy second_proxy third_proxy
# And NOTE that NTLM cannot pass through another proxy server.
PARENT_PROXY:isa.afpa-roubaix.local

PARENT_PROXY_PORT:8080

# APS will poll the upstream proxy and attempt to fail-over to a new one if it doesn't
# get a response within an appropriate time frame. The amount of time that it will
# wait for a response before attempting fail-over is specified, in seconds, below:
PARENT_PROXY_TIMEOUT:30

# Set to 1 if you want to grant this authorization service to clients from other computers.
# NOTE: all the users from other hosts that will be using you copy of APS for authentication
# will be using your credentials in NTLM auth at the remote host.
ALLOW_EXTERNAL_CLIENTS:0

# If you want to allow some other but not all computers to use your proxy for authorization,
# just set ALLOW_EXTERNAL_CLIENTS:0 and put friendly IP addresses here.
# Use space as a delimiter.
# NOTE that special addesses don't work here (192.168.3.0 for example).
FRIENDLY_IPS:0

# Requested URLs are written to "url.log" file. May be useful.
URL_LOG:0

# When a network service listens for connections, there is a maximum number of connection
# attempts to that service that the underlying OS will allow to backlog waiting for a response
# before the OS will start dropping new connection attempts with 'Connection refused'. The
# standard method of determining the maximum number of backlogged connections is to use the
# SOMAXCONN constant, which is supposed to represent the maximum number that an OS will support
# (for example, 5 on Windows 2000 Pro, and 200 on Windows 2000 server). However, because this
# is a statically compiled value in a Python distribution, usually this instead represents the
# the most conservative value (5 on all Windows platforms, and 128 on the GNU/Linux variant I
# tried). So if you are running (for example) a massively threaded/parallel download manager,
# the default value of, say, 5, or whatever SOMAXCONN happens to be set to, may be too low and
# cause some connections to fail. The value below can be set to any integer (it seems that
# Python just silently caps values above the hard limit for the underlying platform), or it can
# be set to the special value of SOMAXCONN (i.e.
MAX_CONNECTION_BACKLOG:SOMAXCONN), to use
# whatever this value happens to be set to in your Python build. Setting this higher than
# necessary may cause APS to consume more memory than you needed to.
MAX_CONNECTION_BACKLOG:5

#========================================================================
[CLIENT_HEADER]

# This section describes what and how the server should change in the clients headers.
# Made in order to prevent parent proxy from seeing that you are using wget instead of IE5.5

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,application/vnd.ms-excel, application/msword,application/vnd.ms-powerpoint, */*
#User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)
# for windows 2000 emulation Wink
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT5)

# You can uncomment these chages in client's header to mimic IE5+ better, but in this case
# you may expirience problems with *.html if your client does not really handle compression.
Accept-Encoding: gzip, deflate

#========================================================================
[NTLM_AUTH]

# Optional value, if leaved blank then APS will use
gethostname() to determine
# host's name.
# NOTE1: If you Linux host name differs from Windows host name then it may be that
# MS server wont recognize you host at all and wont grant you access
# to resources requested. Then you have to use this option and APS will use
# this name in NTLM negotiations.
# NOTE2: There are several reports that you can successfully use "foreign" host name
# here. Say, if user may access a resource from 'host1' and may not from 'host2'
# then there is a chance that APS running on 'host2' with NT_HOSTNAME:host1 will
# be able to be granted access to the restricted resource. However use this on
# you own risk as such a trick may be considered as a hack or something.
NT_HOSTNAME: C008-pc-5216491.afpa-roubaix.local

# Windows Domain.
# NOTE: it is not full qualified internet domain, but windows network domain.
NT_DOMAIN: afpa-roubaix.local

# What user's name to use during authorization. It may differ form real current username.
# If you enable NTLM_TO_BASIC, below, you can either leave this blank or simply
# hash it out.
USER: my_username

# Password. Just leave it blank here and server will request it at the start time,
# or, if you enable NTLM_TO_BASIC, below, you can either leave this blank or simply
# hash it out, and you *won't* be prompted for a password at start time.
PASSWORD: my_password

# These two options replace old FULL_NTLM option.
# NTLM authentication consists virtually of two parts: LM and NT. Windows95/98 use
# only LM part, WindowsNT/2000 can use NT and LM or just NT part.
# Almost always using just LM part will be enough. I had several reports
# about LM and NT requirement and no about just NT.
# So try to setup 1, 1 only if you have enough reasons to do so and when you understand
# what you are doing.
# 0, 0 is an illegal combination
# NOTE: if you change these options then you have to setup flag option accordingly.
LM_PART:1
NT_PART:0

# Highly experimental option. See research.txt for details.
# LM - 06820000
# NT - 05820000
# LM + NT - 07820000
NTLM_FLAGS: 06820000

# This option makes APS try to translate NTLM authentication to very usual "Basic"
# scheme. Almost all http clients know it. With this option set to 1 user will be requested
# by his browser to enter his credentials and these username and password will be used by
# APS for NTLM authentication at MS Proxy server or Web server.
# In such a case different users can use one runnig APS with their own credentials.
# NOTE1: currently translation works so it allows only one try for entering
# username/password. If you make a mistake you will have to restart you browser.
# NOTE2: With debug:1 basic username/password will be written in log file in clear
# text format. I could try hide it, but the basic scheme is so weak that anybody
# who had access to APS would be able to get it.
NTLM_TO_BASIC:0

#========================================================================
[DEBUG]

# Set this to 1 if you want to see debug info in many log files. One per connection.
DEBUG:0

# Set this to 1 to get even more debug info.
BIN_DEBUG:0

# Set this to 1 to see some strange activity on screen. Actually you won't want it.
SCR_DEBUG:1

# Not actually a debug option but gives you some details on authentication process
# into *.auth logs. Also see research.txt.
AUTH_DEBUG:0

i have added in terminal
export http_proxy=http://127.0.0.1:8080
export ftp_proxy=http://127.0.0.1:8080

i have edit /etc/apt/apt.conf for add :
Acquire::http::Proxy "http://127.0.0.1:8080";

but nothing works

please help

thank you

ps : sorry for bad english , i'm french

ntlm kubuntu blues

Hi,

I've compared your cfg with mine and the only differences I can see (apart from users/domains etc) are that you have your LISTEN_PORT and PARENT_PROXY_PORT set with the same value and you have smaller value for timeouts.

I'm using Kubuntu 7.04 and mine works fine through the ISA server here at work.

I don't use Acquire::http::Proxy "http://127.0.0.1:8080"; in apt.conf, I just run
pdcl-vaio3 # export http_proxy=http://127.0.0.1:5865
pdcl-vaio3 # export ftp_proxy=http://127.0.0.1:5865
from terminal before I issue an apt-get.

I use the same version as your NTLM, 0.9.9.0.1

I did try setting the ports to the same value as yours and it ran fine.

Can you ping the address of the isa/proxy server set in PARENT_PROXY?

I also set the proxy values in the network settings using kcontrol under "manually specify proxy settings"

The only time I duplicated your error was when I had an invalid repository address but that eventually timed out.

Can you access any websites from konqueror? (after you have set the proxy values in kcontrol)

If you want I can send you my server.cfg and you could just change the values you need and give that a try?

And the last question which perhaps should have been the first, I do everything backwards as my wife keeps telling me, do you still have the problem?

Bez.

More in Tux Machines

today's leftovers

  • Lenovo Chromebook C330 2-in-1

    Today we are looking at the Lenovo Chromebook C330 (81HY0000US), it is a 2-1 device, a notebook but it can also be converted into a tablet. It comes with a fanless quad-core MediaTek MT8173C CPU, an 11.6 inch, 1366x768, IPS display, and touch screen. It has 4gb of RAM and 64GB eMMC SSD.

  • Foliate Ebook Reader Picks Up Mobi & Amazon Kindle Support

    The Foliate ebook reader app for Linux has added support for additional ebook formats, including those used by the Amazon Kindle. Now, I’m conscious that I’ve mentioned Foliate a lot recently. I generally don’t like to do that — anyone remember the omg! docky! days? — but some developers are so dang prolific, able to knock out notable update after notable update at a regular clip, that I have no choice! Foliate’s developer, John Factotum, is one such dev — nice work!

  • Install & Run Xampp on Ubuntu 19.04 using Terminal
  • How to scan your Docker installment with docker-bench-test
  • KDE Applications 19.08 branches created

    Make sure you commit anything you want to end up in the KDE Applications 19.08 release to them

  • OpenMandriva Lx 4.1 Aiming To PGO More Packages, Use IWD For WiFi Connections

    While OpenMandriva Lx 4.0 was just released last month, we are already looking forward to OpenMandriva 4.1 for a number of improvements and some new features. OpenMandriva's developer board provides an interesting look at what's ahead for OpenMandriva Lx 4.1. Already completed for this next milestone include migrating to LLVM Clang 9, and using LD.lld and BFD as the default linkers.

  • Installing Debian 10

    Debian 10 Buster was released recently. It is the newest version on Debian operating system. Debian 10 comes with Linux Kernel 4.19. It also comes with latest Linux graphical desktop environment such as GNOME 3.30, KDE Plasma 5.14, Cinnamon 3.8, LXDE 0.99.2, LxQt 0.14, MATE 1.20, Xfce 4.12 and many more. Debian 10 also comes with awesome new artworks. In this article, I am going to show you how to install Debian 10 Buster on your computer.

  • Workload Consolidation: The Entire IoT in One Box

    To deliver the benefits of workload consolidation while ensuring robust partitioning, congatec has developed a proof of concept based on a six-core Core i7-based COM Express module, a type 1 hypervisor from Real-Time Systems, and Ubuntu Linux.

  • 100,985,047 have been invited to the Evite data breach “party”

    Did you get an invitation to the latest data breach? Over the weekend it was disclosed that Evite, the online invitation platform that has sent more than a few birthday and pizza party invitations over the years, suffered a data breach that included over 100 million accounts.

  • The Gecko Hacker's Guide to Taskcluster

    I spent a good chunk of this year fiddling with taskcluster configurations in order to get various bits of continuous integration stood up for WebRender. Taskcluster configuration is very flexible and powerful, but can also be daunting at first. This guide is intended to give you a mental model of how it works, and how to add new jobs and modify existing ones. I'll try and cover things in detail where I believe the detail would be helpful, but in the interest of brevity I'll skip over things that should be mostly obvious by inspection or experimentation if you actually start digging around in the configurations. I also try and walk through examples and provide links to code as much as possible.

Events: Plasma Sprint, PyCon, SciPy and All Systems Go!

  • Plasma sprint, 2019 edition; personal updates

    In June, I had a great time at a series of KDE events held in the offices of Slimbook, makers of fantastic Neon-powered laptops, at the outskirts of Valencia, Spain. Following on from a two-day KDE e.V. board of directors meeting, the main event was the 2019 edition of the Plasma development sprint. The location proved to be quite ideal for everything. Slimbook graciously provided us with two lovely adjacent meeting rooms for Plasma and the co-located KDE Usability & Productivity sprint, allowing the groups to mix and seperate as our topics demanded - a well-conceived spatial analog for the tight relationship and overlap between the two. [...] In KDE e.V. news, briefly we stole one of the sprint rooms for a convenient gathering of most of our Financial Working Group, reviewing the implementation of the annual budget plan of the organization. We also had a chance to work with the Usability goal crew (have you heard about KDE goals yet?) on a plan for the use of their remaining budget -- it's going to be exciting. As a closing note, it was fantastic to see many new faces at this year's sprint. It's hard to believe for how many attendees it was their first KDE sprint ever, as it couldn't have been more comfortable to have them on board. It's great to see our team grow.

  • Real Python at PyCon US 2019
  • Quansight presence at SciPy'19

    Yesterday the SciPy'19 conference ended. It was a lot of fun, and very productive. You can really feel that there's a lot of energy in the community, and that it's growing and maturing. This post is just a quick update to summarize Quansight's presence and contributions, as well as some of the more interesting things I noticed.

  • ASG! 2019 CfP Re-Opened!

    Due to popular request we have re-opened the Call for Participation (CFP) for All Systems Go! 2019 for one day. It will close again TODAY, on 15 of July 2019, midnight Central European Summit Time! If you missed the deadline so far, we’d like to invite you to submit your proposals for consideration to the CFP submission site quickly! (And yes, this is the last extension, there's not going to be any more extensions.)

GNOME: GSOC, GNOME Foundation, GLib

  • Gaurav Agrawal: GSOC Progress by Mid July

    July Marked the beginning of II GSOC coding month. This month our goal is to make the diff bar model as accurate and intuitive as possible. One of the biggest thing which I learnt so far is how to contribute on upstream repositories on which our project depends. In our case this was with Libgit2, we discovered a bug in Libgit2 while doing our project, and Albfan made this a perfect example to show me how to contribute on upstream, how to raise bugs and how to do discussions for getting it solved.

  • Jean-François Fortin Tam: Available for hire, 2019 edition

    Sometime after the end of my second term on the GNOME Foundation, I was contacted by a mysterious computer vendor that ships a vanilla GNOME on their laptops, Purism.

  • Array copying and extending in GLib 2.61.2

    A slightly more in-depth post in the mini-series this time, about various new functions which Emmanuel Fleury has landed in GLib 2.61.2 (which is due to be released soon), based on some old but not-quite-finished patches from others.

Programming: Python, Vim, Go and More

  • How to integrate jenkins with webhook
  • Serving Gifs With Discord Bot - Reading Time: 12 Mins
  • Python Snippet 1: More Uses For Else
  • Python Celery Guide
  • Python String Find()
  • PyCharm 2019.2 Beta #2

    It hasn’t been long since we published PyCharm 2019.2 Beta, and now we’re ready to share with you the second Beta build! The final release date is getting closer and closer, and while you wait, give PyCharm 2019.2 Beta #2 a go! Get the PyCharm 2019.2 Beta build from our website and try all the latest functionality.

  • Vimrc Tutorial

    In this article, we’re going to dive deep into the vimrc file of Vim. Once you’re inside the vimscript, it’s easy to mess things up. That’s why this rule of thumb will always be helpful in your journey with Vim. Don’t put any line in vimrc that you don’t understand.

  • CPU atomics and orderings explained

    Sometimes the question comes up about how CPU memory orderings work, and what they do. I hope this post explains it in a really accessible way.

  • You can't say Go without Google – specifically, our little logo, Chocolate Factory insists

    Back in 2009, Google chose to name its latest programming language Go, a decision that is still giving it a migraine It could have called it "Google Go" to avoid confusion with Frank McCabe's Go! programming language. Despite criticism, it didn't do so. After almost a year of online grumbling, Google software engineer Russ Cox, in 2010, closed GitHub Issue #9, dismissing the complaints as "unfortunate." And the headaches over the thing's name still won't go away (no pun intended.) Last week, Google rebuffed a request to remove its logo from the Go website, golang.org, a change supported by some developers who feel Google takes Go developers for granted.