I am trying to setup cntlm on ubuntu13 for NTLM authentication. I used apt-get install to setup ctlm. My cntlm.conf file in the etc directory is copied below - the username/domain and password are correct (I have tested them with a different application).


    # Cntlm Authentication Proxy Configuration

    Username        account
    Domain          xxxxxx.com
    Password        password

    # Workstation   netbios_hostname

   Proxy                xxx.xxx.xxx.xxx:3128

    NoProxy         localhost, 127.0.0.*, 10.*, 192.168.*, 0.0.*

    Listen          3128

    #SOCKS5Proxy    8010
    #SOCKS5User     dave:password

    #Auth           NTLM2
    #Flags          0x06820000

    #Gateway        yes

    #Deny           0/0

    #ISAScannerSize     1024
    #ISAScannerAgent    Wget/
    #ISAScannerAgent    APT-HTTP/
    #ISAScannerAgent    Yum/

    #Header         User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)
    #Tunnel         11443:remote.com:443

Error Message in /var/log/syslog:

Proxy returning invalid challenge!

cntlm is running on port 3129 (squid running on port 3128). I pointed IE to use the proxy on the IP address and port number for cntlm (I tried with squid as well) - however, the connection times out. Any suggestions on troubleshooting this will be appreciated.


Sounds like your firewall is disallowing this connection. You can confirm by temporarily disabling it.

$ sudo ufw disable

To allow these ports access:

$ sudo ufw allow 3128/tcp
$ sudo ufs allow 3129/tcp

You can also see what's open using status:

$ sudo ufw status

Firewall loaded

To                         Action  From
--                         ------  ----
22:tcp                     DENY
22:udp                     DENY
22:tcp                     DENY
22:udp                     DENY
22:tcp                     ALLOW
22:udp                     ALLOW

If it's disabled:

$ sudo ufw status
Status: inactive


  • thanks though I am not certain that's the issue - I have not enabled ip tables/ufw on this VM. cntlm and squid are able to listen on ports 3129 and 3128 - squid works with basic auth for me. I am trying to get cntlm to work with squid to test NTLM auth. I have tried adding squid port as parent proxy in the cntlm conf file (even tried tinyproxy) - I just see the connection dropped/reset by the AD server (I checked network packets for troubleshooting this issue) - its possible that AD might have firewall rules but I am able to authenticate against AD from a different VM using a separate appl. – ali haider Apr 14 '14 at 22:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.