This is a text-only version of the following page on --- Title : Use Ubuntu behind a Microsoft ForeFront TMG proxy with cntlm Author : Remy van Elst Date : 27-10-2018 URL : Format : Markdown/HTML --- ![][1] Recently I had to deploy a few machines in a network where outgoing network access was forced through a Microsoft Forefront TMG proxy. For all the Windows clients this went automatically due to domain policies, for Linux this has to be set up manually. Defining the proxy in `/etc/environment` was not enough since NTML authentication is required, which is not supported by default. I found `cntlm`, a piece of software which acts as a local proxy, translating all requests to authenticated NTLM requests to your upstream proxy. This guide covers the (offline) installation, setup, getting the correct password hash and system-wide configuration. It should work on a desktop as well, but I did not test that.

Recently I removed all Google Ads from this site due to their invasive tracking, as well as Google Analytics. Please, if you found this content useful, consider a small donation using any of the options below:

I'm developing an open source monitoring app called Leaf Node Monitoring, for windows, linux & android. Go check it out!

Consider sponsoring me on Github. It means the world to me if you show your appreciation and you'll help pay the server costs.

You can also sponsor me by getting a Digital Ocean VPS. With this referral link you'll get $100 credit for 60 days.

This guide was tested on both Ubuntu 16.04 and 18.04. You need a user account with the correct permissions for the proxy. The account will be locked, so make sure you have access the the Active Directory to unlock it when needed. ### Installing cntlm If you can get a temporary exeption for the machine, you can use your favorite package manager to install cntlm: apt-get install cntlm If you have no network access, download the package from [the ubuntu packages site][3]. The `dpkg` file has no dependencies other than `libc`. Place it on the server and install it: dpkg -i cntlm*.deb Make sure the service is not started yet: systemctl stop cntlm ### Configuring cntlm The configuration file lives in `/etc/cntlm.conf` and is very simple. You can setup cntlm as a proxy for other servers, but that is not in the scope of this guide. For me, I used Ansible to configure these few servers. You can put the password as plaintext in the configuration file, but we are not going to do that since the software supports placing the ntlm hash directly. First we use the commandline to figure out which type of hash is used. Use the `-M` (magic) parameter with a username and password to autodetect the correct settings: cntlm -u $USERNAME@$ADDOMAIN -M proxy.$ADDOMAIN.EXT 8080 Password: Example output: Config profile 1/4... OK (HTTP code: 200) ----------------------------[ Profile 0 ]------ Auth NTLMv2 PassNTLMv2 AAAAAAABBBBBBBBBXXXXXXX99999AAAA ------------------------------------------------ The username format is `$USERNAME@$domain`. The password is your domain account's password. The last two parameters are the proxy hostname/ip and port. In this case we have the NTLMv2 hash and the output format. In other cases, there might be an NTLM hash, an NT hash, an LM hash or any combination. In the configuration file, abide to the following rules: * Auth is NT: use only PassNT * Auth is LM: use only PassLM * Auth is NTLM: use both PassLM and PassNT * Auth is NTLMv2: use only PassNTLMv2 If you cannot connect right away or need to generate the hash offline, cntlm can do that as well: echo "P@ssw0rd" | cntlm -H -u $USERNAME -d $ADDOMAIN Output: Password: PassLM xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx PassNT yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy PassNTLMv2 AAAAAAABBBBBBBBBXXXXXXX99999AAAA # Only for user '$USERNAME', domain '$ADDOMAIN' Use your favorite editor to place these values in the configuration file. vim /etc/cntlm.conf The file is self-explanatory, but read through it if you want to setup a gateway. Here is the config we need for the above setup: Username $USERNAME Domain $ADDOMAIN PassNTLMv2 AAAAAAABBBBBBBBBXXXXXXX99999AAAA Auth NTLMv2 Workstation $SERVER_HOSTNAME Proxy proxy.$ADDOMAIN.EXT:8080 NoProxy localhost, 127.0.0.*, 10.*, 192.168.* Listen 3128 `WorkStation` is optional, by default the system hostname is used. The other values like `Proxy` and `Listen` are self-explanatory as well. When your configuration file is done, make sure only root can read it: chmod 600 /etc/cntlm.conf Start the service: systemctl start cntlm ### Testing cntlm Use either cntlm itself with debug on, or a tool like curl with the proxy configured to test the local proxy. #### Testing with curl curl has the `-x` option to provide a proxy. Since `cntlm` is configured and listening on `` we can use it to test with curl: curl -v -x Example output: * Rebuilt URL to: * Trying * Connected to ( port 3128 (#0) > GET HTTP/1.1 > Host: > User-Agent: curl/7.47.0 > Accept: */* > Proxy-Connection: Keep-Alive [...] < HTTP/1.1 200 OK < Via: 1.1 proxy < Connection: Keep-Alive < Proxy-Connection: Keep-Alive < Content-Length: 376 [...] You should be redirected to If that is not the case, please click here to continue. * Connection #0 to host left intact As you can see, the proxy is used and working. If it is not, the output will include something like below: # lots of html 407 Proxy Authentication Required. Forefront TMG requires authorization to fulfill the request. Access to the Web Proxy filter is denied. (12209). Your password hash could be wrong, the account might be locked out or the other authentication credentials are wrong. #### Testing with cntlm Using the `-v` option, for verbose with the `-M` option as before, we can test the connection. cntlm -fv -c /etc/cntlm.conf -M Output: section: global, Username = '$USERNAME' section: global, Domain = '$ADDOMAIN' section: global, PassNTLMv2 = 'AAAAAAABBBBBBBBBXXXXXXX99999AAAA' section: global, Auth = 'NTLMv2' section: global, Workstation = '$SERVER_HOSTNAME' section: global, Proxy = 'proxy.$ADDOMAIN.EXT:8080' section: global, NoProxy = 'localhost, 127.0.0.*, 10.*, 192.168.*' section: global, Listen = '3128' cntlm: Proxy listening on Adding no-proxy for: 'localhost' Adding no-proxy for: '127.0.0.*' Adding no-proxy for: '10.*' Adding no-proxy for: '192.168.*' cntlm: Using proxy proxy.$ADDOMAIN.EXT:8080 cntlm: Resolving proxy proxy.$ADDOMAIN.EXT... Config profile 1/4... Resolve proxy.$ADDOMAIN.EXT: -> NTLM Request: Domain: $ADDOMAIN Hostname: $SERVER_HOSTNAME Flags: 0xA208B205 Sending PROXY auth request... Proxy-Connection => keep-alive Host => Proxy-Authorization => NTLM xxxx Content-Length => 0 Reading PROXY auth response... HEAD: HTTP/1.1 407 Proxy Authentication Required ( Access is denied. ) Via => 1.1 proxy Proxy-Authenticate => NTLM xxxx Connection => Keep-Alive Proxy-Connection => Keep-Alive Pragma => no-cache Cache-Control => no-cache Content-Type => text/html Content-Length => 0 NTLM Challenge: Challenge: xxx (len: 208) Flags: 0xA2898205 NT domain: $ADDOMAIN Server: proxy Domain: $ADDOMAIN.EXT FQDN: proxy.$ADDOMAIN.EXT TLD: $ADDOMAIN.EXT 7: TBofs: 66 TBlen: 142 ttype: 0 NTLMv2: Nonce: xxxxxxxxxxxxxxxxxx Timestamp: 131850205990000000 NTLM Response: Hostname: '$SERVER_HOSTNAME' Domain: '$ADDOMAIN' Username: '$USERNAME' Response: 'xxxx' (190) Response: 'xxxx' (24) HEAD: HTTP/1.1 200 OK OK (HTTP code: 200) ----------------------------[ Profile 0 ]------ Auth NTLMv2 PassNTLMv2 AAAAAAABBBBBBBBBXXXXXXX99999AAAA ------------------------------------------------ cntlm: Terminating with 0 active threads The `200 OK` is what we're looking for. Stuff like below is wrong, just as above, check your credentials and config: HEAD: HTTP/1.1 407 Proxy Authentication Required ( Forefront TMG requires authorization to fulfill the request. Access to the Web Proxy filter is denied. ) Credentials rejected Wrong credentials, invalid URL or proxy doesn't support NTLM nor BASIC. The account will be locked, so make sure you have access the the Active Directory to unlock it. ### Systemwide proxy configuration When the proxy is working, you make it available for the entire system. Most software will understand this, but make sure to check the specific manpages if software is not working for you. Edit the following file: vim /etc/environment Append the following: http_proxy="" https_proxy="" ftp_proxy="" no_proxy="localhost,,localaddress," HTTP_PROXY="" HTTPS_PROXY="" FTP_PROXY="" NO_PROXY="localhost,,localaddress," Save it and logout. Log back in to make it active. For `apt-get`, you need to edit the following file: vim /etc/apt/apt.conf Append the following: Acquire::http::proxy ""; Acquire::ftp::proxy ""; Acquire::https::proxy ""; After logging out and in, test it with curl once again, but now without the `-x` option (so no proxy is specified, but the system proxy is used): curl -v Output: * Rebuilt URL to: * Trying * Connected to ( port 3128 (#0) > GET HTTP/1.1 > Host: > User-Agent: curl/7.47.0 > Accept: */* > Proxy-Connection: Keep-Alive > < HTTP/1.1 200 OK < Via: 1.1 proxy < Connection: Keep-Alive [1]: [2]: [3]: --- License: All the text on this website is free as in freedom unless stated otherwise. This means you can use it in any way you want, you can copy it, change it the way you like and republish it, as long as you release the (modified) content under the same license to give others the same freedoms you've got and place my name and a link to this site with the article as source. This site uses Google Analytics for statistics and Google Adwords for advertisements. You are tracked and Google knows everything about you. Use an adblocker like ublock-origin if you don't want it. All the code on this website is licensed under the GNU GPL v3 license unless already licensed under a license which does not allows this form of licensing or if another license is stated on that page / in that software: This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . Just to be clear, the information on this website is for meant for educational purposes and you use it at your own risk. I do not take responsibility if you screw something up. Use common sense, do not 'rm -rf /' as root for example. If you have any questions then do not hesitate to contact me. See for details.