Language Selection

English French German Italian Portuguese Spanish

kubuntu vs MS ISA Proxy ft apt-get

Recently I had to install an app on Kubuntu through apt but found that I was locked behind a MS ISA Proxy server at work. I read numerous articles and help responses in the forums that suggested adding a line to /etc/apt/apt.conf with the required proxy settings.

I added the regulatory Acquire::http::proxy http://username:password@server and nothing worked. It does not allow the use of the domain name\username combination. Neither does the export environment setting. This poses a bit of a problem if your proxy server is expecting both.

After a wee bit of research (about 20 mins as I get bored following the worldwide tangent and end up on IMDB for an hour before remembering what I was looking for in the first place) I stumbled upon this:

Ensure python is installed first, then

Download the latest version of NTLMAPS from

http://sourceforge.net/projects/ntlmaps/

Yes, I know you can’t connect to the proxy server but if you change konqueror’s proxy settings:

open Konqueror,
SETTINGS
CONFIGURE KONQUEROR
scroll to PROXY
select Manually specify proxy setting - setup

and enter your proxy server settings you will be prompted to enter your username and password and this prompt WILL let you input it with the DOMAIN\USERNAME format.

Extract the contents of the downloaded file into a directory using your preferred extraction tool.

In a shell, or if you are already in one, CD into the directory and use VI or your favourite editor to modify server.cfg

Change:
LISTEN_PORT:5865 --swap for whatever local port you want

PARENT_PROXY_PORT:8080 --swap for your servers port

NT_DOMAIN:pdcl --swap for your domain name

USER:steve --swap for your username

PASSWORD:notgoingtotellyou --swap for your password

Save your changes and exit back to the prompt

Start the server with

pdcl-vaio3:/# python main.py

Open a new shell, keeping the previous one open, and export the following

pdcl-vaio3:/# export http_proxy=http://127.0.0.1:(local LISTEN_PORT that you set in server cfg)

pdcl-vaio3:/# export ftp_proxy=http://127.0.0.1:(local LISTEN_PORT that you set in server cfg)

Then start adept

pdcl-vaio3:/# Kdesu adept-manager

(kdesu if you are not running as root or don't have root access)

I’m fairly confident the same process will work in Ubuntu using synaptic, but either flavour can use apt-get etc in the shell.

* For browsing, open konqueror and change the settings under proxy server to local (127.0.0.1) and the port you set in server.cfg

There you go, Robert is your mother’s brother, updates through your company’s ISA proxy server.

*I recently tried this on openSuse but no matter what the setting, or combination of settings I couldn't get YaST to work on updates.

*It does, however, work on Fedora with yum, you just need to modify yum.conf and add the local proxy setting in there.

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

ntlm and kubuntu7.04

hello ,

I have a problem with kubuntu and apt-get , when i load ./main.py and
tape sudo apt-get update, i have this :

vieurou@vieurou-desktop:~/ntlmaps-0.9.9.0.1$ ./main.py
NTLM authorization Proxy Server v0.9.9.0.1
Copyright (C) 2001-2004 by Dmitry Rozmanov and others.
Now listening at vieurou-desktop on port 8080
Connected from 127.0.0.1:51018
Connected from 127.0.0.1:51019
Connected from 127.0.0.1:51020
Connected from 127.0.0.1:51021
Connected from 127.0.0.1:51022
Connected from 127.0.0.1:51023
Connected from 127.0.0.1:51024
....

but i have not dot (before, with kubuntu 6.10, ntml working good, whith the same server.cfg, some of dot appear..)

this is a copy paste of my server.cfg :

#========================================================================
[GENERAL]

LISTEN_PORT:8080

# If you want APS to authenticate you at WWW servers using NTLM then just leave this
# value blank like PARENT_PROXY: and APS will connect to web servers directly.
# You can specify more than one proxy by leaving a space
between each one, and
# APS will detect when one fails and automatically fail-over to the next. EG:
#PARENT_PROXY:first_proxy second_proxy third_proxy
# And NOTE that NTLM cannot pass through another proxy server.
PARENT_PROXY:isa.afpa-roubaix.local

PARENT_PROXY_PORT:8080

# APS will poll the upstream proxy and attempt to fail-over to a new one if it doesn't
# get a response within an appropriate time frame. The amount of time that it will
# wait for a response before attempting fail-over is specified, in seconds, below:
PARENT_PROXY_TIMEOUT:30

# Set to 1 if you want to grant this authorization service to clients from other computers.
# NOTE: all the users from other hosts that will be using you copy of APS for authentication
# will be using your credentials in NTLM auth at the remote host.
ALLOW_EXTERNAL_CLIENTS:0

# If you want to allow some other but not all computers to use your proxy for authorization,
# just set ALLOW_EXTERNAL_CLIENTS:0 and put friendly IP addresses here.
# Use space as a delimiter.
# NOTE that special addesses don't work here (192.168.3.0 for example).
FRIENDLY_IPS:0

# Requested URLs are written to "url.log" file. May be useful.
URL_LOG:0

# When a network service listens for connections, there is a maximum number of connection
# attempts to that service that the underlying OS will allow to backlog waiting for a response
# before the OS will start dropping new connection attempts with 'Connection refused'. The
# standard method of determining the maximum number of backlogged connections is to use the
# SOMAXCONN constant, which is supposed to represent the maximum number that an OS will support
# (for example, 5 on Windows 2000 Pro, and 200 on Windows 2000 server). However, because this
# is a statically compiled value in a Python distribution, usually this instead represents the
# the most conservative value (5 on all Windows platforms, and 128 on the GNU/Linux variant I
# tried). So if you are running (for example) a massively threaded/parallel download manager,
# the default value of, say, 5, or whatever SOMAXCONN happens to be set to, may be too low and
# cause some connections to fail. The value below can be set to any integer (it seems that
# Python just silently caps values above the hard limit for the underlying platform), or it can
# be set to the special value of SOMAXCONN (i.e.
MAX_CONNECTION_BACKLOG:SOMAXCONN), to use
# whatever this value happens to be set to in your Python build. Setting this higher than
# necessary may cause APS to consume more memory than you needed to.
MAX_CONNECTION_BACKLOG:5

#========================================================================
[CLIENT_HEADER]

# This section describes what and how the server should change in the clients headers.
# Made in order to prevent parent proxy from seeing that you are using wget instead of IE5.5

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,application/vnd.ms-excel, application/msword,application/vnd.ms-powerpoint, */*
#User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)
# for windows 2000 emulation Wink
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT5)

# You can uncomment these chages in client's header to mimic IE5+ better, but in this case
# you may expirience problems with *.html if your client does not really handle compression.
Accept-Encoding: gzip, deflate

#========================================================================
[NTLM_AUTH]

# Optional value, if leaved blank then APS will use
gethostname() to determine
# host's name.
# NOTE1: If you Linux host name differs from Windows host name then it may be that
# MS server wont recognize you host at all and wont grant you access
# to resources requested. Then you have to use this option and APS will use
# this name in NTLM negotiations.
# NOTE2: There are several reports that you can successfully use "foreign" host name
# here. Say, if user may access a resource from 'host1' and may not from 'host2'
# then there is a chance that APS running on 'host2' with NT_HOSTNAME:host1 will
# be able to be granted access to the restricted resource. However use this on
# you own risk as such a trick may be considered as a hack or something.
NT_HOSTNAME: C008-pc-5216491.afpa-roubaix.local

# Windows Domain.
# NOTE: it is not full qualified internet domain, but windows network domain.
NT_DOMAIN: afpa-roubaix.local

# What user's name to use during authorization. It may differ form real current username.
# If you enable NTLM_TO_BASIC, below, you can either leave this blank or simply
# hash it out.
USER: my_username

# Password. Just leave it blank here and server will request it at the start time,
# or, if you enable NTLM_TO_BASIC, below, you can either leave this blank or simply
# hash it out, and you *won't* be prompted for a password at start time.
PASSWORD: my_password

# These two options replace old FULL_NTLM option.
# NTLM authentication consists virtually of two parts: LM and NT. Windows95/98 use
# only LM part, WindowsNT/2000 can use NT and LM or just NT part.
# Almost always using just LM part will be enough. I had several reports
# about LM and NT requirement and no about just NT.
# So try to setup 1, 1 only if you have enough reasons to do so and when you understand
# what you are doing.
# 0, 0 is an illegal combination
# NOTE: if you change these options then you have to setup flag option accordingly.
LM_PART:1
NT_PART:0

# Highly experimental option. See research.txt for details.
# LM - 06820000
# NT - 05820000
# LM + NT - 07820000
NTLM_FLAGS: 06820000

# This option makes APS try to translate NTLM authentication to very usual "Basic"
# scheme. Almost all http clients know it. With this option set to 1 user will be requested
# by his browser to enter his credentials and these username and password will be used by
# APS for NTLM authentication at MS Proxy server or Web server.
# In such a case different users can use one runnig APS with their own credentials.
# NOTE1: currently translation works so it allows only one try for entering
# username/password. If you make a mistake you will have to restart you browser.
# NOTE2: With debug:1 basic username/password will be written in log file in clear
# text format. I could try hide it, but the basic scheme is so weak that anybody
# who had access to APS would be able to get it.
NTLM_TO_BASIC:0

#========================================================================
[DEBUG]

# Set this to 1 if you want to see debug info in many log files. One per connection.
DEBUG:0

# Set this to 1 to get even more debug info.
BIN_DEBUG:0

# Set this to 1 to see some strange activity on screen. Actually you won't want it.
SCR_DEBUG:1

# Not actually a debug option but gives you some details on authentication process
# into *.auth logs. Also see research.txt.
AUTH_DEBUG:0

i have added in terminal
export http_proxy=http://127.0.0.1:8080
export ftp_proxy=http://127.0.0.1:8080

i have edit /etc/apt/apt.conf for add :
Acquire::http::Proxy "http://127.0.0.1:8080";

but nothing works

please help

thank you

ps : sorry for bad english , i'm french

ntlm kubuntu blues

Hi,

I've compared your cfg with mine and the only differences I can see (apart from users/domains etc) are that you have your LISTEN_PORT and PARENT_PROXY_PORT set with the same value and you have smaller value for timeouts.

I'm using Kubuntu 7.04 and mine works fine through the ISA server here at work.

I don't use Acquire::http::Proxy "http://127.0.0.1:8080"; in apt.conf, I just run
pdcl-vaio3 # export http_proxy=http://127.0.0.1:5865
pdcl-vaio3 # export ftp_proxy=http://127.0.0.1:5865
from terminal before I issue an apt-get.

I use the same version as your NTLM, 0.9.9.0.1

I did try setting the ports to the same value as yours and it ran fine.

Can you ping the address of the isa/proxy server set in PARENT_PROXY?

I also set the proxy values in the network settings using kcontrol under "manually specify proxy settings"

The only time I duplicated your error was when I had an invalid repository address but that eventually timed out.

Can you access any websites from konqueror? (after you have set the proxy values in kcontrol)

If you want I can send you my server.cfg and you could just change the values you need and give that a try?

And the last question which perhaps should have been the first, I do everything backwards as my wife keeps telling me, do you still have the problem?

Bez.

More in Tux Machines

Switching from MacBook to Chromebook: Is Chrome OS good enough?

Chrome OS often gets maligned as a platform that you can't do "real work" on, and in some cases, that's true. But sometimes, you don't need a computer that does absolutely everything, and that's why I decided to give switching to Chrome OS on my laptop a try. While I've retained my iMac as a proper workstation, my aging MacBook Air was due for an upgrade, and the opportunity to switch platforms presented itself. Could a simpler, cheaper Chromebook replace my MacBook for working on the go? While I found that the answer was decidedly "no" in some situations—and that simply adapting to Chrome OS and its limitations was a huge adjustment—I do think Chrome now has a place in my workflow, albeit one that is rather hit or miss. Chrome is also definitely still a problematic platform, and those limitations tend to define it in a lot of ways, which I'll explore more in this post. For some added context, here are the devices I'm throwing into the mix: I use a 27-inch iMac with 40GB of RAM and a 9th-gen 3.7GHz 6-core Intel Core i5 at home while my MacBook is running on 4GB of RAM and an aging 4th-gen dual-core Core i5. My new laptop/convertible is a 14-inch HP Chromebook x360 with 8GB of RAM and an 8th-gen dual-core Intel Core i3 (Taylor reviewed a similarly equipped variant here at Android Police). Read more

Programming Leftovers

  • Dirk Eddelbuettel: #3 T^4: Customizing The Shell

    The third video (following the announcement, the shell colors) one as well as last week’s shell prompt one, is up in the stil new T^4 series of video lightning talks with tips, tricks, tools, and toys. Today we cover customizing the shell some more.

  • Why slowing new feature development can be the best way to maintain an open source project

    John Byrd is credited with a great statement: "Good programmers write good code. Great programmers write no code. Zen programmers delete code." It's perhaps an overstatement, but the idea behind it is spot on: As a code base accumulates cruft over time, great engineers will invest the time necessary to strip the code of technical debt. As DJ Walker-Morgan once put it, "Deleted lines [of code] are the final burn down of the ground where tech debt built." [...] We've seen this same principle applied in other projects. Apache Cassandra is a good, recent example. In talking with Cassandra insiders, there was a point when stability took precedence in the Cassandra community, with Apple, Netflix, and other big users of Cassandra joining forces on this goal as users got stuck on version 3.11. As cool as it sounds to issue yet another release, Cassandra users were tiring of revalidating their databases every two months when a new release hit. The Cassandra 4.0 effort has been a broad-based, community effort to get the Cassandra house in order.

  • The End is Near for Zend Server Basic PHP

    Zend Server Basic, the free PHP runtime used by thousands of IBM i shops, will cease being offered starting in July 2021. That’s the word from Perforce, the company that now owns Zend and its lineup of PHP tools and technologies. The replacement, of course, is the new community edition of PHP that became available via RPM in late 2019. Starting in 2006, Zend Technology began to develop a special version of its PHP runtime for IBM i, which was then called i5/OS. This offering, dubbed Zend Core for i5/OS, provided a familiar way for users of the iSeries server (as it was known back then) to partake of the digital bounty that was (and is) the PHP language and the estimated 10,000 software applications that ran on it at the time. While nobody knows for sure how many IBM i (System i, iSeries, AS/400, etc.) shops adopted Zend Core for i5/OS and its follow-ons and continued to use it to power their PHP applications on the box over the years, the number is almost certainly currently measured in the thousands. Back in 2006, IT Jungle reported that, according to Zend, there had been thousands of downloads of the beta of Zend Core for i5/OS just four months after it was released in March 2006.

  • PestPHP Released as Open-Source

    Console legend Nuno Maduro has open-sourced Pest, an elegant PHP testing framework that focuses on simplicity.

  • Seungha Yang: Unfortunately GStreamer 1.17

    Unfortunately GStreamer 1.17 is a development version and any binary/installer is not officially released. But you can build it using Cerbero which is a project for packaging GStreamer framework, or simpler way is that you might be able to try gst-build, that’s a meta-project to build GStreamer mostly used for development purpose.

  • How the End of Life for Open Source Python 2 Affects Enterprises
  • Test and Code: 114: The Python Software Foundation (PSF) Board Elections - Ewa Jodlowska / Christopher Neugebauer

    "The mission of the Python Software Foundation is to promote, protect, and advance the Python programming language, and to support and facilitate the growth of a diverse and international community of Python programmers." That's a lot of responsibility, and to that end, the PSF Board Directors help out quite a bit. If you want to be a part of the board, you can. There's an election coming up right around the corner and you gotta get your nomination in by May 31. You can also join the PSF if you want to vote for who gets to be part of the board.

  • Consistent Hashing

    Consistent hashing is a hashing technique that performs really well when operated in a dynamic environment where the distributed system scales up and scales down frequently. The core concept of Consistent Hashing was introduced in the paper Consistent Hashing and RandomTrees: Distributed Caching Protocols for Relieving Hot Spots on the World Wide Web but it gained popularity after the famous paper introducing DynamoDB - Dynamo: Amazon’s Highly Available Key-value Store. Since then the consistent hashing gained traction and found a ton of use cases in designing and scaling distributed systems efficiently. The two famous examples that exhaustively use this technique are Bit Torrent, for their peer-to-peer networks and Akamai, for their web caches. In this article we dive deep into the need of Consistent Hashing, the internals of it, and more importantly along the way implement it using arrays and Binary Search.

  • Hazelcast CTO: 25 years of Java, welcome to the data-driven 3rd act

    It’s easy to forget how important Java – celebrating its 25th birthday – has been. Before Java, computing was a place of siloed and proprietary clients and servers. Java was more than just a programming language – it was essentially a platform for building a wide range of applications. Java delivered a consistent and efficient programming experience for developers combined with write-once-run-anywhere portability. Today, we see that in containerisation and cloud. Java is poised to begin its third act – supporting cloud-native, data-intensive applications in analytics and Artificial Intelligence and IoT on 5G. That’s because Java’s foundations have continued to develop along with those first principles of developer productivity – simpler to build, more efficient code – with platform scale and performance. Not, that Java’s data destiny was manifest – Java’s had wobbles.

CMS-Centric FOSS Funding

  • London-based New Vector nabs €4.1 million for ‘Matrix’, its decentralised comms ecosystem

    Today New Vector, who is behind new collaboration solutions used by European governments and organisations alike, has announced raising approximately €4.1 million from Automattic Inc. This new investor brings both the financial backing and experience of being the parent company of web publishing and e-commerce platforms WordPress.com, WooCommerce, Jetpack, and enterprise WordPress VIP. New Vector, founded in 2017, is on a mission to enable governments, businesses and individuals to run their own secure communication infrastructure, while interconnecting via the global Matrix network. So far the startup has developed Riot, the flagship Matrix-based messaging app, and Modular, the leading Matrix-based hosting platform. New Vector, formed by the team who created Matrix, also provides significant development to the Matrix open source project (an open network for secure, decentralised communication which lets organisations and individuals run their own collaboration apps).

  • Automattic pumps $4.6M into New Vector to help grow Matrix, an open, decentralized comms ecosystem
  • Headless CMS company Strapi raises another $10 million
  • Open-Source 'Headless' CMS Company Strapi Raises $10 Million

    Strapi — the open-source “headless” content management system (CMS) — announced it raised $10 million in Series A funding led by Index Ventures. Including this round of funding, the company has raised a total of $14 million. Previously, Strapi raised $4 million in seed funding in October 2019 with Accel and Stride.VC. And the company also hired former Docker head of community Victor Coisne as VP of marketing and the company also announced plans to open its first U.S. office in San Francisco.

TeleIRC 2.0.0 Released

  • TeleIRC v2.0.0 is officially here!

    After almost eight months of work, the TeleIRC Team is happy to announce General Availability of TeleIRC v2.0.0 today. Thanks to the hard work of our volunteer community, we are celebrating an on-time release of a major undertaking to make a more sustainable future for TeleIRC.

  • What’s new in TeleIRC v2.0.0

    TeleIRC v2.0.0 is the latest major release of our open source Telegram <=> IRC bridge. Download the latest release and read the release announcement for the full story. There are several new and noteworthy changes in TeleIRC v2.0.0. This post walks you through the major changes and differences for TeleIRC v2.0.0. Read on for the highlight reel of this release.