Generally accepted is the use of HTTP_PROXY/HTTPS_PROXY environment variables to specify the use of a proxy server. Authentication can be included in this URL, e.g. HTTP_PROXY=http://user:pass@myproxy.mydomain.tld:3128/.

However, I am using Kerberos SSO to authenticate with the proxy. How do I configure that? So, suppose a Squid proxy server configuration as described here: https://wiki.squid-cache.org/ConfigExamples/Authenticate/Kerberos. It describes how Windows clients can use proxy authentication with negotiation, but there's no information how I can configure Linux/Unix clients.

For cURL, the use of --proxy-negotiate -u : does the trick, e.g.:

HTTPS_PROXY=http://myproxy.mydomain.tld:3128/ curl --proxy-negotiate -u : https://www.google.com

How do I tell non-cURL applications to use this mechanism? E.g. Debian/Ubuntu APT with Acquire::http::Proxy "http://myproxy.mydomain.tld:3128/";?

I found cntlm which acts as another locally running proxy in the middle, facilitating unauthenticated connections from localhost. However, this only works with NTLM, where I need Kerberos. Would Squid be able to connect as a client using Kerberos perhaps? It seems notoriously hard to find authentication capabilities on the outgoing connection of proxy servers. All seem to focus on authentication features on the listening socket instead.

  • I use cntlm at work but not with kerberos so even I wouldn't be able to test it but a short googling led me to this: sourceforge.net/p/cntlm/feature-requests/_discuss/thread/…. Can you try it? – Arkadiusz Drabczyk Dec 25 '17 at 20:42
  • 1
    I applied this patch to cntlm 0.92.3, you can get the source code here drabczyk.org/cntlm-with-kerberos.tar.gz. You need to do ./configure --enable-kerberos. – Arkadiusz Drabczyk Dec 25 '17 at 21:05
  • 4
    Looking at the code you now need to pass gss to -a. Here on the bottom on the page github.com/metaphox/cntlm-gss some shows an example configuration. – Arkadiusz Drabczyk Dec 25 '17 at 21:10
  • The thing with kerberos authentication is that you need a kerberos-aware version of each application you want to use through Kerberos. In addition to that, in case of http proxies you also need the http client to be capable of handshaking the kerberos authentication to the proxy-http server using the http Negotiate protocol. Something that curl knows how to do, but I’m afraid apt doesn’t. AFAIK, apt only supports either plaintext http-auth or socks5 – LL3 Mar 29 at 15:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.