Cntlm安装和配置体验

最新推荐文章于 2024-08-24 08:15:12 发布

aofan9566

最新推荐文章于 2024-08-24 08:15:12 发布

阅读量185

点赞数 1

原文链接：http://www.cnblogs.com/lcchuguo/p/4854709.html

版权

对于那些谁使用NTLM验证网络代理环境（即除了需要设置的代理主机和端口还需要提供一个域用户名和密码）供。通过代理上网头疼。这主要是由于非常大的软件不支持NTLM的代理（比方眼下的GIT就不能支持NTLM验证，即使在代理中指定了域帐号和密码，在连接过程中依旧报： Received HTTP code 407 from proxy after CONNECT ，说明验证并未通过）。假设有这样一种工具能封装NTLM验证然后对外提供普通的HTTP代理服务。那么第三方应用就能够通过配置普通的代理訪问网络了，这就是Cntlm (项目官网：http://cntlm.sourceforge.net/）所要解决的问题！由于Cntlm也有linux版本号，这意味着在linux系统上通过NTLM身份验证的网络代理也是可行的。本文原文出处: http://blog.csdn.net/bluishglc/article/details/37600773 严禁不论什么形式的转载，否则将托付CSDN官方维护权益！

配置

下载安装Cntlm之后。仅仅须要改动cntlm.ini文件，提供身份认证必要的信息，然后以服务的方式启动cntlm就能够了。

在cntlm.ini中有例如以下几个重要的配置是可能须要改动的：

Username - your domain/proxy account name

Domain - the actual domain name

Workstation - NetBIOS name of your workstation; Cntlm tries to autodetect it, but you might want to set it explicitly should dialect detection fail (see below)

Proxy - IP address (or ping-able hostname) of your proxy; if you use several alternative proxies or know of backup ones, use this option multiple times; if one stops working, Cntlm will move on to the next

Listen - local port number which Cntlm should bind to; the default is OK, but remember you can't have more than one application per port; you can use netstat to list used up ports (lines with LISTEN)

当中Listen配置项是cntlm将在本地打开的作为普通代理的端口。假如我的windows域是abc,帐号是laurence,密码是123，代理server是192.168.0.1：80，则cntlm.ini应该例如以下配置：

#
# Cntlm Authentication Proxy Configuration
#
# NOTE: all values are parsed literally, do NOT escape spaces,
# do not quote. Use 0600 perms if you use plaintext password.
#

Username	laurence
Domain		abc
Password	123
# NOTE: Use plaintext password only at your own risk
# Use hashes instead. You can use a "cntlm -M" and "cntlm -H"
# command sequence to get the right config for your environment.
# See cntlm man page
# Example secure config shown below.
# PassLM          1AD35398BE6565DDB5C4EF70C0593492
# PassNT          77B9081511704EE852F94227CF48A793
### Only for user 'testuser', domain 'corp-uk'
# PassNTLMv2      D5826E9C665C37C80B53397D5C07BBCB

# Specify the netbios hostname cntlm will send to the parent
# proxies. Normally the value is auto-guessed.
#
# Workstation	netbios_hostname

# List of parent proxies to use. More proxies can be defined
# one per line in format <proxy_ip>:<proxy_port>
#
Proxy		192.168.0.1:80

# List addresses you do not want to pass to parent proxies
# * and ?

wildcards can be used # NoProxy localhost, 127.0.0.*, 10.*, 192.168.* # Specify the port cntlm will listen on # You can bind cntlm to specific interface by specifying # the appropriate IP address also in format <local_ip>:<local_port> # Cntlm listens on 127.0.0.1:3128 by default # Listen 3128 # If you wish to use the SOCKS5 proxy feature as well, uncomment # the following option. It can be used several times # to have SOCKS5 on more than one port or on different network # interfaces (specify explicit source address for that). # # WARNING: The service accepts all requests, unless you use # SOCKS5User and make authentication mandatory. SOCKS5User # can be used repeatedly for a whole bunch of individual accounts. # #SOCKS5Proxy 8010 #SOCKS5User dave:password # Use -M first to detect the best NTLM settings for your proxy. # Default is to use the only secure hash, NTLMv2, but it is not # as available as the older stuff. # # This example is the most universal setup known to man, but it # uses the weakest hash ever. I won't have it's usage on my # conscience. :) Really, try -M first. # #Auth LM #Flags 0x06820000 # Enable to allow access from other computers # #Gateway yes # Useful in Gateway mode to allow/restrict certain IPs # Specifiy individual IPs or subnets one rule per line. # #Allow 127.0.0.1 #Deny 0/0 # GFI WebMonitor-handling plugin parameters, disabled by default # #ISAScannerSize 1024 #ISAScannerAgent Wget/ #ISAScannerAgent APT-HTTP/ #ISAScannerAgent Yum/ # Headers which should be replaced if present in the request # #Header User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98) # Tunnels mapping local port to a machine behind the proxy. # The format is <local_port>:<remote_host>:<remote_port> # #Tunnel 11443:remote.com:443

当中对于监听端口使用默认的端口3128就能够了。我们能够通过命令来验证配置是否正确：

cntlm -c /path/to/cntlm.ini -I -M http://www.baidu.com

假设能正常返回就表示各项配置都是正确的，接下就能够启动cntlm服务在后台执行了，使用命令：

net start cntlm

服务启动之后，我们就能够在第三方应用的代理配置上这样设定了：代理server：127.0.0.1 （即本机），代理server端口：3128（即cntlm.ini文件里配置的Listen端口）

日志与常见错误

cntlm绝大多数错误表现为服务无法启动。详细原因有非常多，好在cntlm有较好的日志信息能够帮助我们找到问题的根源，查看cntlm日志的方法是：Start -> Settings -> Control Panel -> Administrative Tools -> Event Viewer, 然后在左側面板的文件夹树中选择：Windows Logs -> Application, 再在右側面板中配置一下过虑项，将事件源设定为cntlm就能够过滤出全部的cntlm日志了。

这里我们介绍两种可能的错误：

1. cntlm: PID XXXX: Possible duplicate cygwin1.dll: /socat-1.7.2.1/cygwin1.dll.

相似这种错误是由于cygwin1.dll冲突引起的。有多种工具会携带自己的cygwin1.dll，假设版本号不兼容就会报如上的错误，最简单的方是先移除它们。

2. cntlm: Parent proxy address missing

这是一个easy造成误导的错误，假设多数情况下并非由于你在cntlm.ini中错误地制定了Proxy而是cntlm程序启动时根本没用找到cntlm.ini文件，造成这种问题的可能诱因之中的一个是在安装cntlm时改动了默认的安装文件夹，这应该是cntlm的一个bug。不知道在启动cntlm服务的配置界面（Control Panel -> Administrative Tools -> Services）上指定-c參数是否有效。有有兴趣的朋友可以试试，我按照默认配置重装cntlm已解决。