Perl Package Manager via NTLM proxy

Question

I've installed ActivePerl and the include PPM at work, but I'm unable to get it connect to the module repository through the proxy. I've set up an environment variable

HTTP_PROXY = http://user:pass@proxy.full.name:port

but PPM still shows a 407 error Proxy Authentication Required. I think it's an NTLM proxy, but I'm not sure.

After doing this, I get an Error 500: Bad hostname for ppm4.activestate.com. Turns out PPM asks my DNS server to resolve that name, but my local DNS server cannot resolve such external domain names. Only the proxy does such thing and only for HTTP traffic...

Here's the screenshot of what Wireshark (running on an BackTrack VM on the same Windows XP box) is showing:

My Windows box is 10.75.82.221 The DNS server is 10.7.3.110

This what TraceRoute shows from Windows:

G:\>tracert ppm4.activestate.com
No se puede resolver el nombre de destino ppm4.activestate.com.

Which means:

Cannot resolve ppm4.activestate.com

as expected.

As I said on the comments, the browser doesn't seem to launch any DNS query. Here's a Wireshark screenshot (from BT) that shows an access to www.google.es from Firefox (from WXP):

My Windows box is 10.75.82.221 The proxy is 10.7.8.46

As you can see, no DNS query whatsoever when accessing through browser...

To me, it just seems it's a security feature and I'll have to ask for permission to let me use ActiveState's PPM tool... which is not plausible, even if most (99%) of the scripts I make here are for speeding the work.

Answer 1

Solving error 407 is described in the perl.org Questions and Answers :

Q: Even when http_proxy is set to the correct server with the proper credentials (using the convention username:password@server.tld:port) I'm still not able to install packages via cpan. "LWP failed with code[407] message[Proxy Authentication Required ( The ISA Server requires authorization to fulfill the request. Access to the Web Proxy service is denied. )]"

A: CPAN doesn't support NTLM authentication, and it's difficult to get Authen::NTLM working with CPAN. I ended up using ntlmaps as a local proxy for NTLM authentication.

The first thing you'll need to do is get the latest version of NTLMAPS from their svn repo, extract it somewhere. Next you'll need to get the latest version of python and install it. Open NTLMAPS' server.cfg, set PARENT_PROXY to your proxy's address or IP, PARENT_PROXY_PORT to the port the proxy runs on (usually 80 or 8080), NT_DOMAIN to your domain, and USER to your username.

Run runserver.bat. It will ask for your password, enter it and press enter. Next you have to configure cpan to use NTLMAPS as a proxy. Go to strawberry\perl\lib\CPAN and open Config.pm. Set http_proxy to http://localhost:5865. Run CPAN and use it as you normally would. Now you should only have to start up NTLMAPS before running CPAN to get it to run properly.

Just a quick note, you may need to force LM + NT authentication rather than LM; To do this, open the NTLMAPS server.cfg set NT_PART to 1 and NTLM_FLAGS to 07820000.

Removing HTTP_PROXY and modifiying CPAN/Config.pm as stated may solve the problem.

Summary of the comments below:

The study of wireshark dumps shows that ActivePerl issues DNS requests that are returned as unknown by the DNS server. The solutions possible are only :

1. Reconfiguration of the DNS server (impossible for the poster)
2. Launching a request on the ActiveState Community Site to stop these futile requests (no guarantee of any speedy relief)
3. Manually download and install the modules (only practical solution left).

Answer 2

If it's NTLM, you'll need the NTLM Perl module. The ActiveState PPM documentation says you can obtain a ppmx package from the repository, but I couldn't find any such link. You still can, however, download the ppd and tar.gz files and install them:

wget http://ppm4.activestate.com/MSWin32-x86/5.12/1205/N/NB/NBEBOUT/NTLM-1.09.ppd
wget http://ppm4.activestate.com/MSWin32-x86/5.12/1205/N/NB/NBEBOUT/NTLM-1.09.tar.gz
ppm install NTLM-1.09.ppd

Also note that, if your computer belongs to a Windows domain, you should not need to give the credentials explicitly - http://proxy.full.name:port should be enough for NTLM/Kerberos, in addition to being more secure.

---

Recently Microsoft software has been switching from NTLM to Kerberos – although usually proxies support both, it can happen that NTLM will be disabled in yours. There is not much documentation on Kerberos proxies with PPM, but HTTP-Negotiate might be worth trying, if you cannot get NTLM to work.

Answer 3

This is a shot in the dark... nobody's mentioned trying this but it sounds like everyone's out of ideas... if this is true:

"Turns out PPM asks my DNS server to resolve that name, but my local DNS server cannot resolve such external domain names."

Then edit:

C:\Windows\System32\Drivers\etc\hosts

add the line:

204.244.102.19  ppm4.activestate.com

See if it makes a difference.

---

For troubleshooting ntlmaps:

There are two options in server.cfg DEBUG and BIN_DEBUG, if you have toubles with the server so set these options to DEBUG:1 and BIN_DEBUG:1 just before requesting a problem page (or resource). You have to restart proxy server to reread server.cfg. This will give you 3 log files per http request (per connection to be exact), like 127.0.0.1-1048, 127.0.0.1-1048.bin.client and 127.0.0.1-1048.bin.rserver. In the first one there is an info on what APS did, two others contain raw traffic from client and from proxy.

http://ntlmaps.sourceforge.net/