ISA server and NTLM

How to connect to ISA server using NTLM authentication from wgte,apt-get..

"ERROR 407: Proxy Authentication Required ( The ISA Server requires authorization to fulfill the request. Access to the Web Proxy filter is denied. ). "

Usually this error pops up when trying to use wget or apt-get in Linux. The server guy is a huge MS fanatic ( in our case ;) ) and it is this MS crap causing problem to access internet resources.

The soultion for this is two use any proxy that will send "windows" queries to the ISA server. Two such proxies that I found interesting are

1) NTLMaps

2) CNTLM

cntlm is availble in the repository and has more advanced features as compared to NTLMaps.

NTLMaps

NTLMaps is a python software. NTLM Authorization Proxy Server is proxy server-like software that just provides NTLM authentication in between your browser and ISA Server, and makes the server believe it's talking to Internet Explorer. It does this by adding NTLM authorization strings to the request headers. It is written in the Python language by Dmitry Rozmanov. It needs Python version 1.5.2 or later.

In a Windows network, NTLM (NT LAN Manager) is a suite of Microsoft security protocols that provides authentication, integrity, and confidentiality to users.

Download it from here: http://sourceforge.net/projects/ntlmaps/files/ntlmaps/ntlmaps-0.9.9.0.1/

There is a configuration file (server.cfg) available that should be edited to get it working. It is properly commented to give which all information to provide. Rajagiri configuration is provided below: (You need just to edit the file )

#========================================================================

[GENERAL]

LISTEN_PORT:5865

# If you want APS to authenticate you at WWW servers using NTLM then just leave this

# value blank like PARENT_PROXY: and APS will connect to web servers directly.

# You can specify more than one proxy by leaving a space between each one, and

# APS will detect when one fails and automatically fail-over to the next. EG:

#PARENT_PROXY:first_proxy second_proxy third_proxy

# And NOTE that NTLM cannot pass through another proxy server.

PARENT_PROXY:192.168.30.1

PARENT_PROXY_PORT:8080

# APS will poll the upstream proxy and attempt to fail-over to a new one if it doesn't

# get a response within an appropriate time frame. The amount of time that it will

# wait for a response before attempting fail-over is specified, in seconds, below:

PARENT_PROXY_TIMEOUT:15

# Set to 1 if you want to grant this authorization service to clients from other computers.

# NOTE: all the users from other hosts that will be using you copy of APS for authentication

# will be using your credentials in NTLM auth at the remote host.

ALLOW_EXTERNAL_CLIENTS:0

# If you want to allow some other but not all computers to use your proxy for authorization,

# just set ALLOW_EXTERNAL_CLIENTS:0 and put friendly IP addresses here.

# Use space as a delimiter.

# NOTE that special addesses don't work here (192.168.3.0 for example).

FRIENDLY_IPS:

# Requested URLs are written to "url.log" file. May be useful.

URL_LOG:0

# When a network service listens for connections, there is a maximum number of connection

# attempts to that service that the underlying OS will allow to backlog waiting for a response

# before the OS will start dropping new connection attempts with 'Connection refused'. The

# standard method of determining the maximum number of backlogged connections is to use the

# SOMAXCONN constant, which is supposed to represent the maximum number that an OS will support

# (for example, 5 on Windows 2000 Pro, and 200 on Windows 2000 server). However, because this

# is a statically compiled value in a Python distribution, usually this instead represents the

# the most conservative value (5 on all Windows platforms, and 128 on the GNU/Linux variant I

# tried). So if you are running (for example) a massively threaded/parallel download manager,

# the default value of, say, 5, or whatever SOMAXCONN happens to be set to, may be too low and

# cause some connections to fail. The value below can be set to any integer (it seems that

# Python just silently caps values above the hard limit for the underlying platform), or it can

# be set to the special value of SOMAXCONN (i.e. MAX_CONNECTION_BACKLOG:SOMAXCONN), to use

# whatever this value happens to be set to in your Python build. Setting this higher than

# necessary may cause APS to consume more memory than you needed to.

MAX_CONNECTION_BACKLOG:5

#========================================================================

[CLIENT_HEADER]

# This section describes what and how the server should change in the clients headers.

# Made in order to prevent parent proxy from seeing that you are using wget instead of IE5.5

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/msword, application/vnd.ms-powerpoint, */*

User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)

# for windows 2000 emulation ;)

# User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT5)

# You can uncomment these chages in client's header to mimic IE5+ better, but in this case

# you may expirience problems with *.html if your client does not really handle compression.

#Accept-Encoding: gzip, deflate

#========================================================================

[NTLM_AUTH]

# Optional value, if leaved blank then APS will use gethostname() to determine

# host's name.

# NOTE1: If you Linux host name differs from Windows host name then it may be that

# MS server wont recognize you host at all and wont grant you access

# to resources requested. Then you have to use this option and APS will use

# this name in NTLM negotiations.

# NOTE2: There are several reports that you can successfully use "foreign" host name

# here. Say, if user may access a resource from 'host1' and may not from 'host2'

# then there is a chance that APS running on 'host2' with NT_HOSTNAME:host1 will

# be able to be granted access to the restricted resource. However use this on

# you own risk as such a trick may be considered as a hack or something.

NT_HOSTNAME:

# Windows Domain.

# NOTE: it is not full qualified internet domain, but windows network domain.

NT_DOMAIN:rasetcentral.edu

# What user's name to use during authorization. It may differ form real current username.

# If you enable NTLM_TO_BASIC, below, you can either leave this blank or simply

# hash it out.

USER:your_username_goes_here

# Password. Just leave it blank here and server will request it at the start time,

# or, if you enable NTLM_TO_BASIC, below, you can either leave this blank or simply

# hash it out, and you *won't* be prompted for a password at start time.

PASSWORD:your_password_goes_here

# These two options replace old FULL_NTLM option.

# NTLM authentication consists virtually of two parts: LM and NT. Windows95/98 use

# only LM part, WindowsNT/2000 can use NT and LM or just NT part.

# Almost always using just LM part will be enough. I had several reports

# about LM and NT requirement and no about just NT.

# So try to setup 1, 1 only if you have enough reasons to do so and when you understand

# what you are doing.

# 0, 0 is an illegal combination

# NOTE: if you change these options then you have to setup flag option accordingly.

LM_PART:1

NT_PART:0

# Highly experimental option. See research.txt for details.

# LM - 06820000

# NT - 05820000

# LM + NT - 07820000

NTLM_FLAGS: 06820000

# This option makes APS try to translate NTLM authentication to very usual "Basic"

# scheme. Almost all http clients know it. With this option set to 1 user will be requested

# by his browser to enter his credentials and these username and password will be used by

# APS for NTLM authentication at MS Proxy server or Web server.

# In such a case different users can use one runnig APS with their own credentials.

# NOTE1: currently translation works so it allows only one try for entering

# username/password. If you make a mistake you will have to restart you browser.

# NOTE2: With debug:1 basic username/password will be written in log file in clear

# text format. I could try hide it, but the basic scheme is so weak that anybody

# who had access to APS would be able to get it.

NTLM_TO_BASIC:0

#========================================================================

[DEBUG]

# Set this to 1 if you want to see debug info in many log files. One per connection.

DEBUG:1

# Set this to 1 to get even more debug info.

BIN_DEBUG:0

# Set this to 1 to see some strange activity on screen. Actually you won't want it.

SCR_DEBUG:0

# Not actually a debug option but gives you some details on authentication process

# into *.auth logs. Also see research.txt.

AUTH_DEBUG:0

To run this just type (from the ntlmaps extracted folder )

# python main.py

NTLM authorization Proxy Server v0.9.9

Copyright (C) 2001-2004 by Dmitry Rozmanov and others.

ERROR: Unable to get the IP address of this machine. This is not a fatal problem, but may cause problems for you using this proxy in some scenarios.

Now listening at debian on port 5865

Dont close this.

In another terminal run the following command

# export http_proxy=http://127.0.0.1:5865

Then wget/apt-get could be used as before

# wget http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.37.1.tar.bz2--2011-02-21 20:31:38-- http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.37.1.tar.bz2

Connecting to 127.0.0.1:5865... connected.

Proxy request sent, awaiting response... 200 OK

Length: 73631752 (70M) [application/x-bzip2]

Saving to: `linux-2.6.37.1.tar.bz2.1'

0% [ ] 2,87,296 11.2K/s eta 1h 46m

For connecting to internet from browser you could use either you original proxy or 127.0.0.1 with port 5865

CNTLM

You could install cnltm with the following command.

# apt-get install cntlm

Now edit the configuration situated at /etc/cntlm.conf

Edit the fields "Username", "Domain", "Workstation", "Password", "Proxy" as we did in the above one. Now execute the following command to generate the password hash.

# cntlm -I -M http://test.com

It will generate the "Auth" and "PassNTLMv2" fileds if everything goes fine.

Auth NTLMv2

PassNTLMv2 0E9A2B32AAGGG8A48B166B2SSDS385

Paste these fileds along with their values to the end of cntlm.conf file and comment or remove the password field. This will helps to remove the password value in the configuration file so that other user also coulnt find the original password.

My conf file is given below.

#

# Cntlm Authentication Proxy Configuration

#

# NOTE: all values are parsed literally, do NOT escape spaces,

# do not quote. Use 0600 perms if you use plaintext password.

#

Username username_goes_here

Domain rasetcentral.edu

#Password # After first giving the password here this line could be removed

Workstation hostname_goes_here # Should be auto-guessed

Proxy 192.168.30.1:8080

#Proxy 10.217.112.42:8080

#

# This is the port number where Cntlm will listen

#

Listen 3128

#

# If you wish to use the SOCKS5 proxy feature as well, uncomment

# the following option, SOCKS5. It can be used several times

# to have SOCKS5 on more than one port or on different network

# interfaces (specify explicit source address for that).

#

# WARNING: The service accepts all requests, unless you use

# SOCKS5User and make authentication mandatory. SOCKS5User

# can be used repeatedly for a whole bunch of individual accounts.

#

#SOCKS5Proxy 8010

#SOCKS5User dave:password

#

# Use -M first to detect the best NTLM settings for your proxy.

# Default is to use the only secure hash, NTLMv2, but it is not

# as available as the older stuff.

#

# This example is the most universal setup known to man, but it

# uses the weakest hash ever. I won't have it's usage on my

# conscience. :) Really, try -M first.

#

#Auth LM

#Flags 0x06820000

#

# Enable to allow access from other computers

#

#Gateway yes

#

# Useful in Gateway mode to allow/restrict certain IPs

#

#Allow 127.0.0.1

#Deny 0/0

#

# GFI WebMonitor-handling plugin parameters, disabled by default

#

#ISAScannerSize 1024

#ISAScannerAgent Wget/

#ISAScannerAgent APT-HTTP/

#ISAScannerAgent Yum/

#

# Headers which should be replaced if present in the request

#

#Header User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)

#

# Tunnels mapping local port to a machine behind the proxy

#

#Tunnel 11443:remote.com:443

Auth NTLMv2

PassNTLMv2 0E9A2B32AAGGG8A48B166B2SSDS385

After that restart the cntlm service to make the changes effective

# /etc/init.d/cntlm restart

Sometimes you need to restart the computer to get the changes into effect.