Member Avatar for rusddso

I need to configure a proxy on my local machine to use an upstream proxy (installed on another machine). The upstream proxy requires Digest/NTLM authorization. I want the local proxy to deal with the upstream proxy's authorization details and provides authorization free access to users that connect to it through my local proxy.

Users (1 ..n) -> LocalProxy(no auth) -> UpstreamProxy(Digest/NTLM auth) -> Customer n/w

This is easy to do when the upstream proxy uses Basic Auth but I don't see how to do it for Digest/NTLM Auth. I see Burp, ZAP can probably do the job but I need a command line solution. Any suggestions ?

Thanks,
Russel

  • 2 Contributors
  • 2 Replies
  • 262 Views
  • 15 Hours Discussion Span
  • Latest Post Latest Post by rusddso

Dani AI

Generated

For (and following ’s OS check) — on CentOS 6.x the simplest, reliable command-line approach depends on which upstream scheme you're facing.

If the upstream proxy is using NTLM: run a small NTLM-aware local proxy such as cntlm. cntlm is designed exactly for this pattern — it listens locally without requiring client auth, performs the NTLM handshake with the corporate/remote proxy, and forwards responses back to clients. Typical flow: Clients → local proxy (no auth) → cntlm (handles NTLM) → upstream proxy. Configure cntlm with your username/domain and parent proxy, store hashes instead of plaintext passwords, bind it to localhost or the internal interface, and run it as a service. You can also put a lightweight Squid instance in front of cntlm if you want caching, ACLs or a single local endpoint for many clients.

Digest is harder because it uses a challenge/nonce per-request (proxy 407 flow). Simple header-rewrite proxies won’t correctly perform the challenge/response. Two practical CLI routes:

  • Use a small programmatic relay that performs HTTP Digest auth to the parent on behalf of clients (a few dozen lines in Python using requests’ HTTPDigestAuth will do). That relay accepts unauthenticated client requests and handles 407 challenges with the upstream.
  • Use an intercepting CLI proxy that supports scripting (for example, mitmproxy) and script the 407/response handshake.

Troubleshooting and security notes: verify the upstream behaviour with a single curl request to see 407 challenges, capture traffic with tcpdump to confirm Proxy-Authorization headers, and ensure your local proxy binds only to internal interfaces. Always prefer hashed credentials (or a service account) and limit which hosts can connect to the local proxy. For a quick proof-of-concept, get cntlm running first (if NTLM) — it’s the least work — and only implement a custom relay if the upstream requires Digest.

Recommended Answers

All 2 Replies

Member Avatar for kanhakv

i am sorry, but you are configuring on Linux or what?

Member Avatar for rusddso

Yes, all clients and proxies are running Linux. I am using CentOS 6.x for this setup.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.