Git Product home page Git Product logo

evengard / cntlm Goto Github PK

View Code? Open in Web Editor NEW
130.0 14.0 47.0 1009 KB

PLEASE NOTE THAT THIS FORK IS NOT MAINTAINED! For the maintained fork please refer to https://github.com/versat/cntlm. Cntlm is an NTLM / NTLM Session Response / NTLMv2 authenticating HTTP proxy intended to help you break free from the chains of Microsoft proprietary world. More info on http://cntlm.sourceforge.net/ website. THIS VERSION SUPPORTS SSPI, WHICH ALLOWS USERS WITH SMARTCARD AUTHENTICATION TO USE IT ON WINDOWS BOXES!

License: GNU General Public License v2.0

C 88.09% Shell 3.45% Makefile 2.07% Inno Setup 6.39%

cntlm's Introduction

PLEASE NOTE THAT THIS FORK IS NOT MAINTAINED! For the maintained fork please refer to https://github.com/versat/cntlm

Installation using packages
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Most of the popular distros contain cntlm packages.n their repositories.
You can use the procedures described below to prepare a package of current cntlm
version if desired.

NOTE: generating packages traditionally requires root privileges (to be able to set
proper ownership and permissions on package members). You can overcome that using
fakeroot. However, to install your packages you have to be root.

*** SOURCE TARBALL ***

	$ make tgz
	or
	$ make tbz2

*** DEBIAN PACKAGES ***

1) Quick way:

	$ make deb

2) From Debian/Ubuntu repository:

	Get these files (e.g. apt-get source cntlm):

	cntlm_0.XX-X.diff.gz
	cntlm_0.XX-X.dsc
	cntlm_0.XX.orig.tar.gz

	Compile:

	$ dpkg-source -x cntlm_0.XX-Y.dsc
	$ cd cntlm-0.XX/
	$ dpkg-buildpackage -b -rfakeroot

	Upon installation, the package takes care of creating a dedicated user for
	cntlm, init script integration, manages eventual configuration file updates
	with new upstream versions, things like restart of the daemon after future
	updates, etc. You can later revert all these changes with one command, should
	you decide to remove cntlm from your system.


*** RPM FROM SCRATCH ***

1) Quick way:

	$ make rpm			# you'll need root privs. or fakeroot utility

2) Detailed howto (or if make rpm doesn't work for you)

	To build an RPM package from scratch, as root change to
	/usr/src/[redhat|rpm|whatever]/SOURCES

	Copy there all files from cntlm's rpm/ directory plus appropriate version of
	the source tar.bz2 (see SOURCE TARBALL section above) and type:

	$ rpmbuild -ba cntlm.spec

	Shortly after, you'll have source and binary RPMs ready in your ../SRPMS, resp.
	../RPMS directories.

	If your build cannot find the default config file in /etc, you probably have
	broken RPM build environment. You should add this to your ~/.rpmmacros:
	%_sysconfdir	/etc

*** RPM FROM *.src.rpm ***

	If you just want to create a binary package from src.rpm, as root type:

	$ rpmbuild --rebuild pkgname.src.rpm

	Resulting binary RPM will be at /usr/src/..../RPMS

	If your build cannot find the default config file in /etc, you probably have
	broken RPM build environment. You should add this to your ~/.rpmmacros:
	%_sysconfdir	/etc

*** WINDOWS INSTALLER ***

	Install CygWin and include at least the ghostscript, zip and libgcc packages.

	In case you are using a 64-bit version of CygWin: rename cyggcc_s-1.dll to
	cyggcc_s-seh-1.dll in Makefile and win/setup.iss.
	
	Start a CygWin console by using the shortcut on your desktop or startup menu.
	
	From within the CygWin command shell:
	
	$ cd /cygdrive/yourdrive/your_ctnlm_src_location

	$ ./configure
	$ make

	Prepare all binaries, manuals, config templates, Start Menu links and InnoSetup
	project definition file:

	$ make win

	Then run InnoSetup compiler to pack it all into an automatic installer EXE:

	$ /your/path/to/ISCC.exe win/setup.iss
	or
	Open folder "win" in explorer, right click "setup.iss" and select "Compile".

	Both with generate an installer in the "cntlm" folder.

Traditional installation
~~~~~~~~~~~~~~~~~~~~~~~~
First, you have to compile cntlm. Using the Makefile, this should be very easy:

$ ./configure
$ make
$ make install

Cntlm does not require any dynamic libraries and there are no dependencies you
have to satisfy before compilation, except for libpthreads. This library is
required for all threaded applications and is very likely to be part of your
system already, because it comes with libc. Next, install cntlm onto your
system like so:

Default installation directories are /usr/sbin, /usr/share/man and /etc. Should
you want to install cntlm into a different location, change the DESTDIR
installation prefix (from "/") to add a different installation prefix (e.g.
/usr/local).  To change individual directories, use BINDIR, MANDIR and
SYSCONFDIR:

$ make SYSCONFDIR=/etc BINDIR=/usr/bin MANDIR=/usr/share/man
$ make install SYSCONFDIR=/etc BINDIR=/usr/bin MANDIR=/usr/share/man

Cntlm is compiled with system-wide configuration file by default. That means
whenever you run cntlm, it looks into a hardcoded path (SYSCONFDIR) and tries
to load cntml.conf. You cannot make it not to do so, unless you use -c with an
alternative file or /dev/null. This is standard behaviour and probably what you
want. On the other hand, some of you might not want to use cntlm as a daemon
started by init scripts and you would prefer setting up everything on the
command line. This is possible, just comment out SYSCONFDIR variable definition
in the Makefile before you compile cntlm and it will remove this feature.

Installation includes the main binary, the man page (see "man cntlm") and if
the default config feature was not removed, it also installs a configuration
template. Please note that unlike bin and man targets, existing configuration
is never overwritten during installation. In the doc/ directory you can find
among other things a file called "cntlmd". It can be used as an init.d script.


Architectures
~~~~~~~~~~~~~
The build system now has an autodetection of the build arch endianness. Every
common CPU and OS out there is supported, including Windows, MacOS X, Linux,
*BSD, AIX.


Compilers
~~~~~~~~~
Cntlm is tested against GCC and IBM XL C/C++, other C compilers will work
for you too. There are no compiler specific directives and options AFAIK.
compilers might work for you (then again, they might not). Specific
Makefiles for different compilers are supported by the ./configure script
(e.g. Makefile.xlc)


Contact
~~~~~~~
David Kubicek <[email protected]>

cntlm's People

Contributors

evengard avatar jongiddy avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

cntlm's Issues

Compiled version

Hello, could you please provide a pre-compiled release for this project? My team is very interested in this, however I can't seem to stand up an environment that can build this without errors. We are looking to deploy pre-configured packages to windows and mac computers.

Thank you in advance!

CNTLM fails after reboot on newer Linux distributions

On newer Linux distributions, /var/run links to /run which is a tmpfs directory cleared on each restart. This means that the /var/run/cntlm is deleted on reboot.

When the machine restarts, CNTLM first changes to the cntlm user, and then tries to create the pid file in this directory. Since the directory no longer exists, and /run is only writable by root, this fails.

The simplest solution would be for the daemon to write the pid-file as root, before changing to the non-privileged account.

A workaround is to modify /etc/sysconfig/cntlmd to point PIDFILE to a different location (e.g. PIDFILE="/tmp/cntlmd.pid").

How does cntlm calculate hashes? Is it possible to use NTLM hash to calculate PassNTLMv2?

Hello!

I'm working in the environment with smartcard logon and ntlmv2/Kerberos enforced. Cntlm with NTLMSSPI is not an option (probally need NTLMv2 SSPI which is not implemented at this moment) so I'm trying to "bypass" a corporate proxy with cntlm and NTLM hash of the password which I eventually know :)

I've noticed that cntlm -H results are different from the "standard" password hashes.
As far as I understand, NTLM hash is an MD4(unicode(Password)). For example, NTLM hash of "password" is 8846F7EAEE8FB117AD06BDD830B7586C. However, cntlm -H returns PassNT 77B9081511704EE852F94227CF48A793 for the same "password".

PassNTLMv2 value that is produced by cntlm -H is also different from "standard" HMACMD5(NTLMhash, uppercase username + domain).

I've found an appropriate portions of code in ntlm.c but unfortunately can not understand why hash functions are working this way.

char *ntlm_hash_nt_password(char *password) { char *u16, *keys; int len;

keys = new(21 + 1);
len = unicode(&u16, password);
md4_buffer(u16, len, keys);

memset(keys+16, 0, 5);
memset(u16, 0, len);
free(u16);

return keys;

}

char *ntlm2_hash_password(char *username, char *domain, char *password) { char *tmp, *buf, *passnt, *passnt2; int len;

passnt = ntlm_hash_nt_password(password);

buf = new(strlen(username)+strlen(domain) + 1);
strcat(buf, username);
strcat(buf, domain);
uppercase(buf);
len = unicode(&tmp, buf);

passnt2 = new(16 + 1);
hmac_md5(passnt, 16, tmp, len, passnt2);

free(passnt);
free(tmp);
free(buf);

return passnt2;

}`

The main question is:

Is it possible to implement "pass-the-hash"-like functionality in cntlm (calculate PassNTLMv2 from username, domain and NTLM password hash)?

How to compile on windows?

I have tried installing MingW+Msys, but this is not sufficient.
Any other user has tried building cntlm on windows?

Patch implementing PAM support

I've been working on a patch to integrate cntlm with PAM. It uses shared memory for process communication and checks user's uid in /proc/net/tcp (and, eventually, /proc/net/tcp6) for authenticity (only works in Linux).

It's very simple: first user logs in, then my pam module generates all ntlm's hashes (using cntlm's functions) and saves it in the shared memory; second: cntlm is started (with a new flag: -Z) and looks for user's uid in /proc/net/tcp (through client tcp port), then copy it's credentials from shared memory and voila'!!!

Limitations: only works with Linux and cntlm runs in localhost (127.0.0.1).

PS1: I've already implemented this patch in a previous release (0.35), please check iu out in http://pamcntlm.sf.net
PS2: As far as I known, Firefox only works with a 'hack': is necessary set a Windows user-agent in cntlm.conf :(
Example:
Header User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.86 Safari/537.36

Tested using websense and Windows 2012 domain.
cntlm-0.92.3-pam_cntlm.patch.zip

NTLMv2 for SSPI?

Any chance of adding support for NTLMv2 authentication over SSPI (smartcard, passwordless authentication)? Plain NTLM over SSPI doesn't work for me.

Ta,
Boris

Is this project dead?

Same as the Sourceforge, CNTLM project seems dead. Newer OS's are starting have an array of issues.

Cygwin configure fails on windows 10

user_@DESKTOP-4K2H1C1 ~/cntlm

$ ./configure

./configure: line 12: $'\r': command not found
./configure: line 14: $'\r': command not found
./configure: line 18: syntax error near unexpected token $'do\r'' '/configure: line 18: for c in $CCS; do

how cntlm use dns

it seems cntlm use the window-server ntlm dns not the host that running cntlm app.
I run the cntlm in ubuntu server and change the /etc/hosts file to make some server get the right ip. but it seems failed.

yum update with cntlm fails

Hello!
I've configured yum on a CentOS 6.7 to use a CNTLM proxy but it fails. If I set Firefox to use that proxy it works but not yum. Here is the output when I do a yum update.

******* Round 1 C: 5, S: 6 *******!
Reading headers...
HEAD: GET http://mirrorlist.centos.org/?release=6&arch=i386&repo=os&infra=stock HTTP/1.1
User-Agent                     => urlgrabber/3.9.1 yum/3.2.29
Host                           => mirrorlist.centos.org
Accept                         => */*
Proxy-Connection               => Keep-Alive
NTLM Request:
           Domain: XXXXXX
         Hostname: vagrant
            Flags: 0xA208B205

Sending auth request...
User-Agent                     => urlgrabber/3.9.1 yum/3.2.29
Host                           => mirrorlist.centos.org
Accept                         => */*
Proxy-Connection               => Keep-Alive
Connection                     => Keep-Alive
Proxy-Authorization            => NTLM XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Reading auth response...
HEAD: HTTP/1.1 401 Unauthorized
Cache-Control                  => no-cache
Pragma                         => no-cache
WWW-Authenticate               => NTLM
Content-Type                   => text/html; charset=utf-8
Proxy-Connection               => close
Set-Cookie                     => BCSI-CS-9999999999999999=2; Path=/
Connection                     => close
Content-Length                 => 4259
Got 4259 too many bytes.
Proxy signals it's closing the connection.
Proxy closed connection (i=1, closed=1, so_closed=1). Reconnecting...
Sending headers...
User-Agent                     => urlgrabber/3.9.1 yum/3.2.29
Host                           => mirrorlist.centos.org
Accept                         => */*
Proxy-Connection               => Keep-Alive
Connection                     => Keep-Alive
No body.

******* Round 2 C: 5, S: 6 *******!
Reading headers...
HEAD: HTTP/1.1 401 Unauthorized
Cache-Control                  => no-cache
Pragma                         => no-cache
WWW-Authenticate               => NEGOTIATE
WWW-Authenticate               => NTLM
Content-Type                   => text/html; charset=utf-8
Proxy-Connection               => close
Set-Cookie                     => BCSI-CS-9999999999999999=2; Path=/
Connection                     => close
Content-Length                 => 4259
Sending headers...
Body included. Lenght: 4259
data_send: read 2048 of 2048 / 2048 of 4259 (errno = ok)
data_send: fds 5:6 warning -999 (connection closed)
Could not send whole body

Thread finished.
Joining thread 3077966704; rc: 0

This is my cntlm.ini

Username    xxxxxxxx
Domain      xxxxxx
PassLM          XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
PassNT          XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
PassNTLMv2      XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Proxy       myproxy.internal:80
NoProxy     localhost, 127.0.0.*
Listen      127.0.0.1:3128
Gateway yes

This is what I put in my /etc/yum.cfg

.....
proxy=http://127.0.0.1:3128

And this is the output of yum update

yum update
Loaded plugins: fastestmirror
Setting up Update Process
Loading mirror speeds from cached hostfile
Could not retrieve mirrorlist http://mirrorlist.centos.org/?release=6&arch=i386&repo=os&infra=stock error was
14: PYCURL ERROR 22 - "The requested URL returned error: 401 Unauthorized"
Error: Cannot find a valid baseurl for repo: base

What am I doing wrong? Thank you!

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.