Language Selection

English French German Italian Portuguese Spanish

kubuntu vs MS ISA Proxy ft apt-get

Recently I had to install an app on Kubuntu through apt but found that I was locked behind a MS ISA Proxy server at work. I read numerous articles and help responses in the forums that suggested adding a line to /etc/apt/apt.conf with the required proxy settings.

I added the regulatory Acquire::http::proxy http://username:password@server and nothing worked. It does not allow the use of the domain name\username combination. Neither does the export environment setting. This poses a bit of a problem if your proxy server is expecting both.

After a wee bit of research (about 20 mins as I get bored following the worldwide tangent and end up on IMDB for an hour before remembering what I was looking for in the first place) I stumbled upon this:

Ensure python is installed first, then

Download the latest version of NTLMAPS from

http://sourceforge.net/projects/ntlmaps/

Yes, I know you can’t connect to the proxy server but if you change konqueror’s proxy settings:

open Konqueror,
SETTINGS
CONFIGURE KONQUEROR
scroll to PROXY
select Manually specify proxy setting - setup

and enter your proxy server settings you will be prompted to enter your username and password and this prompt WILL let you input it with the DOMAIN\USERNAME format.

Extract the contents of the downloaded file into a directory using your preferred extraction tool.

In a shell, or if you are already in one, CD into the directory and use VI or your favourite editor to modify server.cfg

Change:
LISTEN_PORT:5865 --swap for whatever local port you want

PARENT_PROXY_PORT:8080 --swap for your servers port

NT_DOMAIN:pdcl --swap for your domain name

USER:steve --swap for your username

PASSWORD:notgoingtotellyou --swap for your password

Save your changes and exit back to the prompt

Start the server with

pdcl-vaio3:/# python main.py

Open a new shell, keeping the previous one open, and export the following

pdcl-vaio3:/# export http_proxy=http://127.0.0.1:(local LISTEN_PORT that you set in server cfg)

pdcl-vaio3:/# export ftp_proxy=http://127.0.0.1:(local LISTEN_PORT that you set in server cfg)

Then start adept

pdcl-vaio3:/# Kdesu adept-manager

(kdesu if you are not running as root or don't have root access)

I’m fairly confident the same process will work in Ubuntu using synaptic, but either flavour can use apt-get etc in the shell.

* For browsing, open konqueror and change the settings under proxy server to local (127.0.0.1) and the port you set in server.cfg

There you go, Robert is your mother’s brother, updates through your company’s ISA proxy server.

*I recently tried this on openSuse but no matter what the setting, or combination of settings I couldn't get YaST to work on updates.

*It does, however, work on Fedora with yum, you just need to modify yum.conf and add the local proxy setting in there.

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

ntlm and kubuntu7.04

hello ,

I have a problem with kubuntu and apt-get , when i load ./main.py and
tape sudo apt-get update, i have this :

vieurou@vieurou-desktop:~/ntlmaps-0.9.9.0.1$ ./main.py
NTLM authorization Proxy Server v0.9.9.0.1
Copyright (C) 2001-2004 by Dmitry Rozmanov and others.
Now listening at vieurou-desktop on port 8080
Connected from 127.0.0.1:51018
Connected from 127.0.0.1:51019
Connected from 127.0.0.1:51020
Connected from 127.0.0.1:51021
Connected from 127.0.0.1:51022
Connected from 127.0.0.1:51023
Connected from 127.0.0.1:51024
....

but i have not dot (before, with kubuntu 6.10, ntml working good, whith the same server.cfg, some of dot appear..)

this is a copy paste of my server.cfg :

#========================================================================
[GENERAL]

LISTEN_PORT:8080

# If you want APS to authenticate you at WWW servers using NTLM then just leave this
# value blank like PARENT_PROXY: and APS will connect to web servers directly.
# You can specify more than one proxy by leaving a space
between each one, and
# APS will detect when one fails and automatically fail-over to the next. EG:
#PARENT_PROXY:first_proxy second_proxy third_proxy
# And NOTE that NTLM cannot pass through another proxy server.
PARENT_PROXY:isa.afpa-roubaix.local

PARENT_PROXY_PORT:8080

# APS will poll the upstream proxy and attempt to fail-over to a new one if it doesn't
# get a response within an appropriate time frame. The amount of time that it will
# wait for a response before attempting fail-over is specified, in seconds, below:
PARENT_PROXY_TIMEOUT:30

# Set to 1 if you want to grant this authorization service to clients from other computers.
# NOTE: all the users from other hosts that will be using you copy of APS for authentication
# will be using your credentials in NTLM auth at the remote host.
ALLOW_EXTERNAL_CLIENTS:0

# If you want to allow some other but not all computers to use your proxy for authorization,
# just set ALLOW_EXTERNAL_CLIENTS:0 and put friendly IP addresses here.
# Use space as a delimiter.
# NOTE that special addesses don't work here (192.168.3.0 for example).
FRIENDLY_IPS:0

# Requested URLs are written to "url.log" file. May be useful.
URL_LOG:0

# When a network service listens for connections, there is a maximum number of connection
# attempts to that service that the underlying OS will allow to backlog waiting for a response
# before the OS will start dropping new connection attempts with 'Connection refused'. The
# standard method of determining the maximum number of backlogged connections is to use the
# SOMAXCONN constant, which is supposed to represent the maximum number that an OS will support
# (for example, 5 on Windows 2000 Pro, and 200 on Windows 2000 server). However, because this
# is a statically compiled value in a Python distribution, usually this instead represents the
# the most conservative value (5 on all Windows platforms, and 128 on the GNU/Linux variant I
# tried). So if you are running (for example) a massively threaded/parallel download manager,
# the default value of, say, 5, or whatever SOMAXCONN happens to be set to, may be too low and
# cause some connections to fail. The value below can be set to any integer (it seems that
# Python just silently caps values above the hard limit for the underlying platform), or it can
# be set to the special value of SOMAXCONN (i.e.
MAX_CONNECTION_BACKLOG:SOMAXCONN), to use
# whatever this value happens to be set to in your Python build. Setting this higher than
# necessary may cause APS to consume more memory than you needed to.
MAX_CONNECTION_BACKLOG:5

#========================================================================
[CLIENT_HEADER]

# This section describes what and how the server should change in the clients headers.
# Made in order to prevent parent proxy from seeing that you are using wget instead of IE5.5

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,application/vnd.ms-excel, application/msword,application/vnd.ms-powerpoint, */*
#User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)
# for windows 2000 emulation Wink
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT5)

# You can uncomment these chages in client's header to mimic IE5+ better, but in this case
# you may expirience problems with *.html if your client does not really handle compression.
Accept-Encoding: gzip, deflate

#========================================================================
[NTLM_AUTH]

# Optional value, if leaved blank then APS will use
gethostname() to determine
# host's name.
# NOTE1: If you Linux host name differs from Windows host name then it may be that
# MS server wont recognize you host at all and wont grant you access
# to resources requested. Then you have to use this option and APS will use
# this name in NTLM negotiations.
# NOTE2: There are several reports that you can successfully use "foreign" host name
# here. Say, if user may access a resource from 'host1' and may not from 'host2'
# then there is a chance that APS running on 'host2' with NT_HOSTNAME:host1 will
# be able to be granted access to the restricted resource. However use this on
# you own risk as such a trick may be considered as a hack or something.
NT_HOSTNAME: C008-pc-5216491.afpa-roubaix.local

# Windows Domain.
# NOTE: it is not full qualified internet domain, but windows network domain.
NT_DOMAIN: afpa-roubaix.local

# What user's name to use during authorization. It may differ form real current username.
# If you enable NTLM_TO_BASIC, below, you can either leave this blank or simply
# hash it out.
USER: my_username

# Password. Just leave it blank here and server will request it at the start time,
# or, if you enable NTLM_TO_BASIC, below, you can either leave this blank or simply
# hash it out, and you *won't* be prompted for a password at start time.
PASSWORD: my_password

# These two options replace old FULL_NTLM option.
# NTLM authentication consists virtually of two parts: LM and NT. Windows95/98 use
# only LM part, WindowsNT/2000 can use NT and LM or just NT part.
# Almost always using just LM part will be enough. I had several reports
# about LM and NT requirement and no about just NT.
# So try to setup 1, 1 only if you have enough reasons to do so and when you understand
# what you are doing.
# 0, 0 is an illegal combination
# NOTE: if you change these options then you have to setup flag option accordingly.
LM_PART:1
NT_PART:0

# Highly experimental option. See research.txt for details.
# LM - 06820000
# NT - 05820000
# LM + NT - 07820000
NTLM_FLAGS: 06820000

# This option makes APS try to translate NTLM authentication to very usual "Basic"
# scheme. Almost all http clients know it. With this option set to 1 user will be requested
# by his browser to enter his credentials and these username and password will be used by
# APS for NTLM authentication at MS Proxy server or Web server.
# In such a case different users can use one runnig APS with their own credentials.
# NOTE1: currently translation works so it allows only one try for entering
# username/password. If you make a mistake you will have to restart you browser.
# NOTE2: With debug:1 basic username/password will be written in log file in clear
# text format. I could try hide it, but the basic scheme is so weak that anybody
# who had access to APS would be able to get it.
NTLM_TO_BASIC:0

#========================================================================
[DEBUG]

# Set this to 1 if you want to see debug info in many log files. One per connection.
DEBUG:0

# Set this to 1 to get even more debug info.
BIN_DEBUG:0

# Set this to 1 to see some strange activity on screen. Actually you won't want it.
SCR_DEBUG:1

# Not actually a debug option but gives you some details on authentication process
# into *.auth logs. Also see research.txt.
AUTH_DEBUG:0

i have added in terminal
export http_proxy=http://127.0.0.1:8080
export ftp_proxy=http://127.0.0.1:8080

i have edit /etc/apt/apt.conf for add :
Acquire::http::Proxy "http://127.0.0.1:8080";

but nothing works

please help

thank you

ps : sorry for bad english , i'm french

ntlm kubuntu blues

Hi,

I've compared your cfg with mine and the only differences I can see (apart from users/domains etc) are that you have your LISTEN_PORT and PARENT_PROXY_PORT set with the same value and you have smaller value for timeouts.

I'm using Kubuntu 7.04 and mine works fine through the ISA server here at work.

I don't use Acquire::http::Proxy "http://127.0.0.1:8080"; in apt.conf, I just run
pdcl-vaio3 # export http_proxy=http://127.0.0.1:5865
pdcl-vaio3 # export ftp_proxy=http://127.0.0.1:5865
from terminal before I issue an apt-get.

I use the same version as your NTLM, 0.9.9.0.1

I did try setting the ports to the same value as yours and it ran fine.

Can you ping the address of the isa/proxy server set in PARENT_PROXY?

I also set the proxy values in the network settings using kcontrol under "manually specify proxy settings"

The only time I duplicated your error was when I had an invalid repository address but that eventually timed out.

Can you access any websites from konqueror? (after you have set the proxy values in kcontrol)

If you want I can send you my server.cfg and you could just change the values you need and give that a try?

And the last question which perhaps should have been the first, I do everything backwards as my wife keeps telling me, do you still have the problem?

Bez.

More in Tux Machines

Red Hat and Fedora

today's leftovers

  • My Experiences Converting Users To GNU/Linux
    My wife, TLW, runs GNU/Linux with few problems. She uses a tablet, an Odroid-C2 ARMed thick client, and a big notebook all running Debian GNU/Linux or Ubuntu and her Android/Linux smartphone and her scanner and printer all deal with Beast, my GNU/Linux server. I have her file-system plugged in via NFS so she can do IT in bed, in front of the TV, on TV, or in her office and all her thousands of pictures, documents, scans etc. are all in the same place. She doesn’t even have much problem using Ubuntu or XFCE4 on Debian because she mostly uses the same applications all day long. It just works for her and memories of That Other Operating System are fading. She was locked to a single thick client with limited capabilities in those Dark Days. She had repeated crashes and malware. Today, her issues with IT are things like changing the name of a file on the FTP server or how to scan a light image or…, real problems, not problems M$ causes billions of people every day.
  • Shame on Microsoft for Leaving Surface Pro Customers in the Dark
    When Microsoft came out with its first batch of Surface tablets a few years ago, the company took a bath on them. It didn't help that they were conceived around the unpopular Windows 8 and the now-defunct Windows RT and that the prospects for the OS were in question. After Microsoft wrote off $900 million on its money-losing Surface business, the deathwatch was on. But the Intel-based Surface Pro and Surface Pro 2 showed a glimmer of hope, and Microsoft finally delivered a solid hit with the Surface Pro 3. After that water­shed release, the Surface division is now an important business that brings in more than $1 billion revenue per quarter. Yet Microsoft isn't showing much appreciation toward the customers who helped put its Surface business on solid footing.
  • A quick introduction to Audacity for teachers
  • SX 2.2 RELEASE
    Skylable is proud to announce immediate availability of SX 2.2. The new release provides a significant performance boost by improving calculation, index usage and maintaining cache of frequently computed values, as well as performing background propagation of all replicas above 1 by default. Additionally, sxfs now enables caching of smaller objects for improved latency. The source code and binary packages are available for download now. SX 2.2 is backward compatible with previous 2.x releases, and all you need to do is to run sxsetup –upgrade on every node after updating it!
  • 3 Awesome Themes For Plank, The Linux Dock App
    Plenty of people use the desktop dock Plank on their Linux desktop — and for good reason. Plank is a nimble, customisable desktop dock for Linux desktops.
  • hackmud, a cyberpunk themed text-based hacking simulator is now out with Linux support
    The game is listed as Single-player and Multi-player, so it's not entirely clear what type of game it is. As it also claims it's an MMO. I think the developer needs to make it much clearer exactly what is online and what is offline.
  • Yooka-Laylee has another trailer, featuring Shovel Knight
  • ContractPatch, Step 2: Understanding the power balance
    At the point you are presented with a job offer, your prospective employer really wants to hire you. Chances are, they’ve screened and interviewed a number of candidates and put a lot of work into the process. Your manager has thought deeply about who they want in the position and has probably imagined how it will all work out with you in the role. Both you and the hiring decision-maker(s) are probably very optimistic about what you’ll accomplish in the role and how well you’ll get along working together. At this point, no one wants to go back to the drawing board and start the process over again. You will be excited to start the new job but it’s worth taking a step back to appreciate the unusual position you are in with your new employer.
  • Epiphany Icon Refresh
  • Black Lab Linux 8 Beta 3 Is Out with Full EFI Support, Based on Ubuntu 16.04 LTS
    Softpedia was informed today, September 26, 2016, by Black Lab Software's CEO Robert J. Dohnert about the availability of the third Beta development snapshot of the upcoming Black Lab Linux 8 GNU/Linux operating system. Black Lab Linux 8 "Onyx" Beta 3 is here approximately three weeks after the second Beta pre-release and it comes with a major change. It is no longer based on Ubuntu 14.04 LTS (Trusty Tahr), as the development team decided to switch base and move to the next Ubuntu LTS version, namely Ubuntu 16.04 LTS (Xenial Xerus).
  • DevOps: All Development, No Database
    Since the last time I touched working code in a production environment, it’s no exaggeration to say that no part of the development process remains untouched. Over the last decade plus, effectively every aspect of the application development process has been scrutinized, rethought and in many cases reinvented. From version control to build systems to configuration and deployment to monitoring, modern development’s toolchain is multi-part and sophisticated. As it must be. Processes that work for code released in cycles measured in months cannot be expected to handle workflows measured in days or minutes. For all that the process of developing software has evolved, however, the database remains curiously overlooked. Consider the example of Cloud Native. Describing a modern, typically legacy-free approach to building applications appropriate for cloud environments, the term Cloud Native has gone from informal descriptor to accepted industry shorthand in short order – to the extent that it has its own technical foundation. If we look at the membership of that foundation, the CNCF, it would appear that the roster includes no database vendors at the Platinum or Gold membership levels, at least if you assume Google’s involvement is around Kubernetes and not tools such as BigQuery. Of the 41 silver members, meanwhile, two can be considered database vendors: Crunchy and Treasure Data.

Red Hat Financial News

Leftovers: OSS and Sharing

  • What does it mean to change company culture?
    Tools are specific concrete things that a culture has decided is a way to improve a process. Buckminster Fuller has a great quote about tools and thinking: "If you want to teach people a new way of thinking, don't bother trying to teach them. Instead, give them a tool, the use of which will lead to new ways of thinking." In particular, DevOps tools can provide folks new ways to look at things—like delivering code into a production environment, for example. But there's lots of examples where a new tool doesn't influence the thinking of the people who use it, so things don't change.
  • Why Open Beats Closed
  • Google Improves Image Recognition; Releases Project as Open Source Software
    Google says its algorithm can correctly caption a photograph with nearly 94 percent accuracy. The company says the improvements come in the third version of its system named Inception, with the score coming from a standardized auto-caption test named ImageNet. It reports the first version scored 89.6 percent, the second 91.8 percent and the new one 93.9 percent.
  • Contributing to Open Source Projects Not Just For the Experts
    XDA has long been a proponent of open source development, and we’ve seen it flourish over the years. In fact, it’s one of the main reasons our community has grown as fast as it has over these past 13 years, with Android’s core being the driving force. Many people desire to be part of open source and contribute but often don’t know how they can, whether because they think they lack the skills or they just don’t have the time.
  • Firefox Reader Mode is Finally Getting a Keyboard Shortcut
    Among the changes which arrived in the September release of Firefox 49 were an enhanced set of Reader Mode features, including spoken narration and line-width spacing options. All very welcome. But the improvements aren’t stopping there. Firefox 50, which is due next month, will add another sorely needed feature: a keyboard shortcut for Reader Mode. Y
  • Introduction to OpenStack by Rich Bowen
    In this talk, Rich, the OpenStack Community Liaison at Red Hat, will walk you through what OpenStack is, as a project, as a Foundation, and as a community of organizations.
  • How Microsoft Measures Open Source Success [Ed: Wim Coekaerts got a bigger salary offer from Microsoft than from Oracle so now he’s propagandist/EEE in chief]
  • Public licenses and data: So what to do instead?
    Why you still need a (permissive) license Norms aren’t enough if the underlying legal system might allow an early contributor to later wield the law as a threat. That’s why the best practice in the data space is to use something like the Creative Commons public domain grant (CC-Zero) to set a clear, reliable, permissive baseline, and then use norms to add flexible requirements on top of that. This uses law to provide reliability and predictability, and then uses norms to address concerns about fairness, free-riding, and effectiveness. CC-Zero still isn’t perfect; most notably it has to try to be both a grant and a license to deal with different international rules around grants.
  • NIST Releases New 'Family' of Standardized Genomes
    With the addition of four new reference materials (RMs) to a growing collection of “measuring sticks” for gene sequencing, the National Institute of Standards and Technology (NIST) can now provide laboratories with even more capability to accurately “map” DNA for genetic testing, medical diagnoses and future customized drug therapies. The new tools feature sequenced genes from individuals in two genetically diverse groups, Asians and Ashkenazic Jews; a father-mother-child trio set from Ashkenazic Jews; and four microbes commonly used in research. NIST issued the world’s first genome reference material (NIST RM 8398)—detailing the genetic makeup for a woman with European ancestry—in May 2015. Together, all five RMs serve as a collection of well-characterized, whole genome standards that can tell a laboratory how well its DNA sequencing processes are working by measuring the performance of the equipment, chemistry and data analysis involved.
  • ANSI Seeks Organizations Interested in Serving as U.S. TAG Administrator for ISO Technical Committee on Blockchain and Electronic Distributed Ledger
  • Industrial IoT leaders work towards interoperability and open source collaboration