没有密码的NTLM代理? [英] NTLM proxy without password?

问题描述

我在使用 HTTP 代理的公司 Windows 网络(我登录到该网络)上工作.当我使用 Internet Explorer 时，它神奇地使用了代理，而无需我输入密码.某些其他程序似乎也管理此问题，例如 JavaWebStart 具有使用浏览器设置"选项.

I work on a corporate windows network (which I log in to) with a HTTP proxy. When I use Internet Explorer it magically uses the proxy without me needing to type in my password. Certain other programs seem to manage this too, like JavaWebStart has a "use browser settings" option.

但是，当我使用 curl 或 wget 等脚本/程序从 http 获取内容时，或者在我的 Java 代码中执行此操作时，我似乎需要将密码存储在某处，这显然不是最安全的.

However when I use scripts/programs like curl or wget to fetch stuff from http, or do it within my Java code I seem to need to have my password stored somewhere, which obviously isn't best for security.

如何以编程方式获得 Internet Explorer 的无密码访问权限?

我认为这是一个堆栈溢出问题，因为我是一名程序员，我需要我的程序/脚本在不输入密码的情况下工作，尽管我可以看到其他人可能认为它属于服务器故障/超级用户.

I'm arguing this is a stack overflow question because I'm a programmer and I need my programs/scripts to work without typing in the password, though I can see that others might think it belongs on Server Fault/Superuser.

我知道 curl 中的 --proxy-ntlm 之类的设置，但这仍然需要 ntlm 用户名和密码.

I know about settings like --proxy-ntlm in curl, but this still requires an ntlm username and password.

推荐答案

在没有其他人回答的情况下，这是我发现的，希望对其他人有用.

In the absence of an answer from someone else here is what I have discovered, I hope it is useful for someone else.

1. 从 http://curl.haxx.se/latest 下载启用了 SSPI 的 curl.cgi?curl=win32-ssl 更改为 Windows、zip、启用 SSL、启用 SSPI (7.19.5).
2. 从 http://www.slproweb.com/products/Win32OpenSSL 安装 Windows Open-SSL.html 并捐赠以支持他的带宽成本.
3. 安装 Visual C++2008 年可再发行版(如果您需要).
4. 使用 curl 获取页面:curl.exe -U : --proxy-ntlm --proxy myproxy.com:8080 http://www.google.com

1. Download SSPI enabled curl from http://curl.haxx.se/latest.cgi?curl=win32-ssl changing to Windows, zip, SSL-enabled, SSPI-enabled (7.19.5).
2. Install Windows Open-SSL from http://www.slproweb.com/products/Win32OpenSSL.html and make a donation to support his bandwidth cost.
3. Install the Visual C++ 2008 redistributables if you need them.
4. Use curl to fetch the page: curl.exe -U : --proxy-ntlm --proxy myproxy.com:8080 http://www.google.com

更详细的说明

使用 Windows 登录机制进行身份验证的神奇短语是 SSPI.这提供了一个很好的谷歌搜索词组.我仍然没有找到在 java 或 wget 中使用 SSPI 进行 HTTP 代理身份验证的好方法.

More detailed explanation

The magic phrase for authentication using the Windows login mechanism is SSPI. This gives a good google search phrase. I still haven't found a good way of using SSPI for HTTP proxy authentication in java or wget though.

但是，curl(下载工具)确实支持 SSPI，但仅在某些构建.不幸的是，默认的 cygwin 构建不是其中之一.您可以通过获取详细的版本信息来了解您的 curl 版本是否支持 SSPI:

However, curl (the download tool) does support SSPI but only in certain builds. Unfortunately the default cygwin build is not one of them. You can find out if your build of curl supports SSPI by getting the verbose version information:

curl -v -V

如果支持 SSPI，将在功能行中提及.

If SSPI is supported it will be mentioned in the features line.

要获得支持 SSPI 的 Windows 版本，我必须访问 http://curl.haxx.se/latest.cgi?curl=win32-ssl 然后将下载选项更改为 Windows、zip、启用 SSL、启用 SSPI (7.19.5).当您阅读本文时，版本号可能已更改.

To get a windows version that supported SSPI I had to go to http://curl.haxx.se/latest.cgi?curl=win32-ssl and then change the download choice to Windows, zip, SSL-enabled, SSPI-enabled (7.19.5). By the time you read this the version number may have changed.

然后从命令行默默地失败了.当我从 Windows 资源管理器运行时，我收到一条关于缺少 libeay32.dll 的消息.从 Windows 获取此信息的一种方法是从 openssl.org 上的唯一链接到 windows 版本.制作者请求捐赠以支付带宽成本.另一种方法是从源代码构建自己的.

This then silently failed from the command line. When I ran from windows explorer I got a message about a missing libeay32.dll. One way of getting this from windows is from the only link at openssl.org to a windows version. The producer of this requests a donation to cover bandwidth costs. Another way would be to build your own from source.

毕竟 curl 使用以下命令行:

And after all that curl worked with the following command line:

curl.exe -U : --proxy-ntlm --proxy myproxy.com:8080 http://www.google.com

-U : 不配置密码，其他命令行选项设置代理.您可能需要更改代理和端口设置.

The -U : configures no password, the other commandline options set up the proxy. You'll probably have to change your proxy and port settings.

如果只有 cygwin 的 curl 版本支持 SSPI，这一切都会容易得多.我现在要去提出一个请求.

This would all be much easier if only cygwin's curl release supported SSPI. I'm going to go put in a request for that now.

这篇关于没有密码的NTLM代理?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！