Px does not seem to be acquiring or using ntlm credentials about px

[genotrance]

Can you please share the logs by enabling with --debug or log = 1 in px.ini?

[genotrance]

By the way, I don't see your comment on the noproxy comment so can you please open an issue and provide logs and you configuration?

[jkordani]

I realized my comment was about another piece of software, cntlm, which was misbahaving for me in other ways. Console paste from --debug follows.

tested with
http_proxy=http://127.0.0.1:3129 wget http://intranet-noproxy-ip/path/to/thing
also with
wget -e use_proxy=yes -e http_proxy=http://127.0.0.1:3129

while watching wireshark. There is no ntlm header in the request.

MainProcess: MainThread: 1528724410: parse_proxy: [('internet-proxy-ip', 80)]
Serving at 127.0.0.1:3129 proc MainProcess
MainProcess: MainThread: 1528724410: parse_config: proxy:server = internet-proxy-ip:80
MainProcess: MainThread: 1528724410: parse_config: proxy:port = 3129
MainProcess: MainThread: 1528724410: parse_config: proxy:listen = 127.0.0.1
MainProcess: MainThread: 1528724410: parse_config: proxy:allow = *.*.*.*
MainProcess: MainThread: 1528724410: parse_config: proxy:gateway = 0
MainProcess: MainThread: 1528724410: parse_config: proxy:hostonly = 0
MainProcess: MainThread: 1528724410: parse_config: proxy:noproxy = intranet-noproxy-ip
MainProcess: MainThread: 1528724410: parse_config: proxy:useragent =
MainProcess: MainThread: 1528724410: parse_config: settings:workers = 2
MainProcess: MainThread: 1528724411: parse_config: settings:threads = 5
MainProcess: MainThread: 1528724411: parse_config: settings:idle = 30
MainProcess: MainThread: 1528724411: parse_config: settings:socktimeout = 5.0
MainProcess: MainThread: 1528724411: parse_config: settings:proxyreload = 60
MainProcess: MainThread: 1528724411: parse_config: settings:foreground = 0
MainProcess: MainThread: 1528724411: parse_config: settings:log = 0

Process-1: MainThread: 1528724412: parse_proxy: [('internet-proxy-ip', 80)]
Serving at 127.0.0.1:3129 proc Process-1
Process-1: MainThread: 1528724412: parse_config: proxy:server = internet-proxy-ip:80
Process-1: MainThread: 1528724412: parse_config: proxy:port = 3129
Process-1: MainThread: 1528724412: parse_config: proxy:listen = 127.0.0.1
Process-1: MainThread: 1528724412: parse_config: proxy:allow = *.*.*.*
Process-1: MainThread: 1528724412: parse_config: proxy:gateway = 0
Process-1: MainThread: 1528724412: parse_config: proxy:hostonly = 0
Process-1: MainThread: 1528724412: parse_config: proxy:noproxy = intranet-noproxy-ip
Process-1: MainThread: 1528724412: parse_config: proxy:useragent =
Process-1: MainThread: 1528724412: parse_config: settings:workers = 2
Process-1: MainThread: 1528724412: parse_config: settings:threads = 5
Process-1: MainThread: 1528724412: parse_config: settings:idle = 30
Process-1: MainThread: 1528724412: parse_config: settings:socktimeout = 5.0
Process-1: MainThread: 1528724412: parse_config: settings:proxyreload = 60
Process-1: MainThread: 1528724412: parse_config: settings:foreground = 0
Process-1: MainThread: 1528724412: parse_config: settings:log = 0

[genotrance]

This isn't the full logs, just startup output. Can you post the full logs from the generated log files in the px directory?

[jkordani]

my mistake.
debug-MainProcess.log
debug-Process-1.log

[genotrance]

Px only supports NTLM auth for the upstream proxy, not NTLM auth for websites. I could add support if there is interest.

[jkordani]

If it's not too much trouble. I'd offer to try to add it myself but I can't be sure how much time I could devote right now. Thank you for your feedback, I'd been trying to figure out how to make this work between px and cnltm with no luck.

[genotrance]

I couldn't find a way to do this with cntlm either, thought it supported this already. Perhaps this should be prioritized higher.

[gophynna]

I would be very much interested in this becoming a feature.

[genotrance]

I just spent a little time looking into this and have run into a major roadblock. If you connect to a website that requires NTLM auth and it is HTTP, Px can do the auth for you.

However, every half decent website these days will use HTTPS, especially if it wants you to authenticate. This means once Px creates a tunnel, everything is now encrypted - including the HTTP headers going between the end client and the web server. Px simply passes data back and forth and has no clue when the web server sends a WWW-Authenticate header.

Effectively, this feature can be added only for HTTP web sites that require NTLM auth but given that's a super small subset of the intranet these days, I don't see the point in implementing this. If this feature was to work on HTTPS as well, Px would have to be an SSL man in the middle, like Bluecoat's proxy, and that's not worth the effort for this use case.

Feedback appreciated but seems like this is a dead end.

[genotrance]

Closing this out unless someone has any suggestions.