Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've installed ActivePerl and the include PPM at work, but I'm unable to get it connect to the module repository through the proxy. I've set up an environment variable

HTTP_PROXY = http://user:pass@proxy.full.name:port

but PPM still shows a 407 error Proxy Authentication Required. I think it's an NTLM proxy, but I'm not sure.

After doing this, I get an Error 500: Bad hostname for ppm4.activestate.com. Turns out PPM asks my DNS server to resolve that name, but my local DNS server cannot resolve such external domain names. Only the proxy does such thing and only for HTTP traffic...

Here's the screenshot of what Wireshark (running on an BackTrack VM on the same Windows XP box) is showing:

My Windows box is 10.75.82.221 The DNS server is 10.7.3.110

Wireshark sniff

This what TraceRoute shows from Windows:

G:\>tracert ppm4.activestate.com
No se puede resolver el nombre de destino ppm4.activestate.com.

Which means:

Cannot resolve ppm4.activestate.com

as expected.

As I said on the comments, the browser doesn't seem to launch any DNS query. Here's a Wireshark screenshot (from BT) that shows an access to www.google.es from Firefox (from WXP):

My Windows box is 10.75.82.221 The proxy is 10.7.8.46

Wireshark sniff

As you can see, no DNS query whatsoever when accessing through browser...

To me, it just seems it's a security feature and I'll have to ask for permission to let me use ActiveState's PPM tool... which is not plausible, even if most (99%) of the scripts I make here are for speeding the work.

share|improve this question
    
Can you connect via a browser ? Does the handling of error 407 in this FAQ seem useful ? –  harrymc Feb 7 '12 at 13:41
    
I can connect via browser, but only to port 80. I didn't try that, gonna do it right now. –  m0skit0 Feb 7 '12 at 14:58
    
I tried that and now I get Error 500 ppm4.activestate.com bad hostname. I modified the corresponding Config.pm for ActivePerl. –  m0skit0 Feb 7 '12 at 16:12
    
I think there is a wrong parameter somewhere. I fear you will have to debug the request/answer packets using fiddler2 or wireshark to find the error. –  harrymc Feb 7 '12 at 16:43
1  
Good. So I converted our discussion into an answer below. Please feel free to modify/add to it via edit. –  harrymc Feb 8 '12 at 16:45

4 Answers 4

up vote 2 down vote accepted
+200

Solving error 407 is described in the perl.org Questions and Answers :

Q: Even when http_proxy is set to the correct server with the proper credentials (using the convention username:password@server.tld:port) I'm still not able to install packages via cpan. "LWP failed with code[407] message[Proxy Authentication Required ( The ISA Server requires authorization to fulfill the request. Access to the Web Proxy service is denied. )]"

A: CPAN doesn't support NTLM authentication, and it's difficult to get Authen::NTLM working with CPAN. I ended up using ntlmaps as a local proxy for NTLM authentication.

The first thing you'll need to do is get the latest version of NTLMAPS from their svn repo, extract it somewhere. Next you'll need to get the latest version of python and install it. Open NTLMAPS' server.cfg, set PARENT_PROXY to your proxy's address or IP, PARENT_PROXY_PORT to the port the proxy runs on (usually 80 or 8080), NT_DOMAIN to your domain, and USER to your username.

Run runserver.bat. It will ask for your password, enter it and press enter. Next you have to configure cpan to use NTLMAPS as a proxy. Go to strawberry\perl\lib\CPAN and open Config.pm. Set http_proxy to http://localhost:5865. Run CPAN and use it as you normally would. Now you should only have to start up NTLMAPS before running CPAN to get it to run properly.

Just a quick note, you may need to force LM + NT authentication rather than LM; To do this, open the NTLMAPS server.cfg set NT_PART to 1 and NTLM_FLAGS to 07820000.

Removing HTTP_PROXY and modifiying CPAN/Config.pm as stated may solve the problem.

Summary of the comments below:

The study of wireshark dumps shows that ActivePerl issues DNS requests that are returned as unknown by the DNS server. The solutions possible are only :

  1. Reconfiguration of the DNS server (impossible for the poster)
  2. Launching a request on the ActiveState Community Site to stop these futile requests (no guarantee of any speedy relief)
  3. Manually download and install the modules (only practical solution left).
share|improve this answer
    
Thanks, I searched extensively on Google but didn't saw that. I already did most of that, except forcing LM + NT auth.Will try. –  m0skit0 Feb 8 '12 at 16:46
    
No go, still Error 500: bad hostname. As I said on the comments above: "[it's the] proxy which filters and resolves the names [for external domains]", so I directly cannot resolve external domain names into IP except through proxy and HTTP. –  m0skit0 Feb 8 '12 at 16:51
    
Strange, this should have worked once configured. See this thread for a similar case (solved). For an alternative solution see this. If nothing works, what exactly does wireshark show? –  harrymc Feb 8 '12 at 17:30
    
I've attached a screenshot with minimal explanation in the question. Thanks for your time! –  m0skit0 Feb 13 '12 at 7:56
    
Can you compare this wireshark trace with the DNS queries as when issued from the browser (which you say does work). The output of tracert ppm4.activestate.com will also be useful. –  harrymc Feb 13 '12 at 8:25

If it's NTLM, you'll need the NTLM Perl module. The ActiveState PPM documentation says you can obtain a ppmx package from the repository, but I couldn't find any such link. You still can, however, download the ppd and tar.gz files and install them:

wget http://ppm4.activestate.com/MSWin32-x86/5.12/1205/N/NB/NBEBOUT/NTLM-1.09.ppd
wget http://ppm4.activestate.com/MSWin32-x86/5.12/1205/N/NB/NBEBOUT/NTLM-1.09.tar.gz
ppm install NTLM-1.09.ppd

Also note that, if your computer belongs to a Windows domain, you should not need to give the credentials explicitly - http://proxy.full.name:port should be enough for NTLM/Kerberos, in addition to being more secure.


Recently Microsoft software has been switching from NTLM to Kerberos – although usually proxies support both, it can happen that NTLM will be disabled in yours. There is not much documentation on Kerberos proxies with PPM, but HTTP-Negotiate might be worth trying, if you cannot get NTLM to work.

share|improve this answer
    
Installed successfully but still no go. For example, I select Win32-EmailSend from PPM to install: Win32-EmailSend marked for install Installing package ... Downloading Win32-EmailSend-0.04 ... failed 407 Proxy Authentication Required Installing package failed ERROR: 407 Proxy Authentication Required –  m0skit0 Feb 1 '12 at 11:48
    
How can I setup HTTP::Negotiate for PPM? I just install it like the NTML module? –  m0skit0 Feb 8 '12 at 8:44

This is a shot in the dark... nobody's mentioned trying this but it sounds like everyone's out of ideas... if this is true:

"Turns out PPM asks my DNS server to resolve that name, but my local DNS server cannot resolve such external domain names."

Then edit:

C:\Windows\System32\Drivers\etc\hosts

add the line:

204.244.102.19  ppm4.activestate.com

See if it makes a difference.


For troubleshooting ntlmaps:

There are two options in server.cfg DEBUG and BIN_DEBUG, if you have toubles with the server so set these options to DEBUG:1 and BIN_DEBUG:1 just before requesting a problem page (or resource). You have to restart proxy server to reread server.cfg. This will give you 3 log files per http request (per connection to be exact), like 127.0.0.1-1048, 127.0.0.1-1048.bin.client and 127.0.0.1-1048.bin.rserver. In the first one there is an info on what APS did, two others contain raw traffic from client and from proxy.

http://ntlmaps.sourceforge.net/

share|improve this answer
    
Thanks, nice idea, didn't think about it. The problem is that if ppm4.activestate.com's IP ever changes, I would have to edit that file again... I'm testing it. –  m0skit0 Feb 14 '12 at 9:10
    
Weird: now PPM says: Downloading ActiveState Package Repository packlist ... failed 500 Can't connect to ppm4.activestate.com:80 (connect: timeout) –  m0skit0 Feb 14 '12 at 9:28
    
nc -n 204.244.102.19 80 doesn't even show on Wireshark... Absolut weirdness... –  m0skit0 Feb 14 '12 at 9:38
    
Is the traffic still being redirected to the proxy? There are some debug options for ntlmaps which might show. –  mgjk Feb 14 '12 at 14:42
1  
@m0skit0, I added new info about enabling ntlmaps debugging to my answer. Unless the logs say something really interesting, I'm out of ideas. Good luck :-) –  mgjk Feb 14 '12 at 15:27

Here is an alternative to using NTLMAPS + Python (as described above by harrymc). The idea is very similar, but more "streamlined":

  • Install Fiddler.
  • Configure PPM to use Fiddler as a proxy. In the command prompt type:

    set http_proxy=http://127.0.0.1:8888
    
  • Make sure to open any Internet page from any browser first (this will create an authenticated session between Fiddler and your corporate Proxy).

  • Give PPM a try.

See the ActiveState Community Site for a bit more details.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.