cntlm provides a solution, along with some configuration.
The basic steps to follow are:
- Install cntlm.
- Edit its configuration file at /etc/cntlm.conf, the comments included makes it easy enough.
- Add a proxy server (or two).
- Specify your user name and NT domain name in the appropriate places, and remove the password entry.
Start the cntlm service, eg via
$ sudo /etc/init.d/cntlm start
cntlm provides a way to test the proxy and generate a hash from your password - eg by the command (as root)
$ cntlm -I -M http://www.test.com
cntlm will prompt for your domain password. Then it will test different authentication mechanisms against the configured proxy server. When a working method is found, it prints two lines which needs to go into its configuration file.
- Stop the cntlm server and add the lines obtained in step 6 above to
/etc/cntlm.conf.
- Restart cntlm
Now cntlm is running and ready to be used. A number of places can be used to configure various programs to use it. cntlm will then transparently add NT domain authentication tokens to outgoing packets and forward them on to the configured proxy server.
Using Qt/KDE
For Qt / KDE native applications, specify "Use manually configured proxy server" in the KDE System Settings -> Network Settings -> Proxy settings. The proxy is specified as http://localhost with the port 3128 (The default for cntlm unless you changed it). These applications are updated dynamically with new settings and no restart or logout/login is required to update the settings.
Dropbox & Google clients
Many applications can use shell environment variables. Noteworthy here are the Dropbox and Google Earth clients. For these applications use shell environment variables like these:
no_proxy=localhost,127.0.0.0/8,*.local
NO_PROXY=localhost,127.0.0.0/8,*.local
all_proxy=socks://localhost:3128/
ALL_PROXY=socks://localhost:3128
http_proxy=http://localhost:3128
HTTP_PROXY=http://localhost:3128
ftp_proxy=http://localhost:3128
FTP_PROXY=http://localhost:3128
https_proxy=http://localhost:3128
HTTPS_PROXY=http://localhost:3128
s3cmd, curl, & wget
Note: Some applications will use only the lower-case names, others only the upper-case names, some will first try the one, then the other.
s3cmd (The Amazon S3 client), curl and wget can additionally be configured via their own configuration files if desired. This is handy because they read their own config files on every invocation. Since these programs are typically short-lived (A single invocation exists after it completes a download) that is very useful.
The format for s3cmd in ~/.s3cfg is:
proxy_host = localhost
proxy_port = 3128
The format for wget in ~/.wgetrc is:
https_proxy = http://localhost:3128
http_proxy = http://localhost:3128
ftp_proxy = http://localhost:3128
The format for curl in ~/.curlrc is:
proxy = localhost:3128
On the other hand editing shell profile or other environment configuration files typically require a restart, log out-and-back-in, or similar. It is worth investigating /etc/environment, ~/.pam_environment, ~/.kde/env/proxy.sh etc as these are standard places to set proxy settings configured via shell environment variables, particularly to affect all users and services on the system.
I also understand that it is possible to change environment settings on a per-application basis using their respective .desktop files but have not tried it (successfully) yet.
VirtualBox
VirtualBox can be configured to use a proxy (for example to check for and to download software updates) using its GUI or using the command:
$ VBoxManage setextradata global GUI/ProxySettings \
"proxyEnabled,localhost,3128,authDisabled,,"
For completeness' sake, to disable it use:
$ VBoxManage setextradata global GUI/ProxySettings \
"proxyDisabled,,,authDisabled,,"
Firefox
For Firefox I use the QuickProxy addon. Firefox itself if configured manually to use the proxy server on the local machine, so QuickProxy merely enable/disable the setting.
APT
APT (used in the background by synaptic, muon and friends) uses a configuration file in /etc/apt/apt.conf.d/, eg 00proxy
Enabling the proxy for APT is done using lines like:
Acquire::http::Proxy "http://localhost:3128";
#Acquire::ftp::proxy "ftp://localhost:3128/";
#Acquire::https::proxy "https://localhost:3128/";
Note: add-apt-repository uses the root profile, or you may configure sudo to allow all the http*_proxy settings to fall through.
A script to rule them all
FWIW I am right now in the process of writing a modular script to enable/disable proxy for numerous programs. I have so far written the following modules:
$ ls -lF proxymanager/modules/
total 60
-rwxr-xr-x 1 root root 919 Oct 8 17:27 apt*
-rwxr-xr-x 1 root root 1037 Oct 8 13:10 bashrc*
-rwxr-xr-x 1 root root 391 Oct 8 12:18 cntlm*
-rwxr-xr-x 1 root root 684 Oct 8 12:58 curl*
-rwxr-xr-x 1 root root 609 Oct 8 13:02 dropbox*
-rwxr-xr-x 1 root root 672 Oct 8 12:18 gnome*
-rwxr-xr-x 1 root root 691 Oct 8 12:18 kde*
-rwxr-xr-x 1 root root 689 Oct 8 13:03 root_bashrc*
-rwxr-xr-x 1 root root 691 Oct 8 13:03 root_curl*
-rwxr-xr-x 1 root root 827 Oct 8 13:03 s3cmd*
-rwxr-xr-x 1 root root 454 Oct 8 13:03 survive_reboot*
-rwxr-xr-x 1 root root 860 Oct 8 13:06 suse-sysproxy*
-rwxr-xr-x 1 root root 653 Oct 8 12:46 sysenvironment*
-rwxr-xr-x 1 root root 465 Oct 8 13:04 virtualbox*
-rwxr-xr-x 1 root root 573 Oct 8 13:04 wgetrc*
As well as a control application. These will hopefully soon be moved into a github or other online home.
