NTLM proxy without password?

by

In the absence of an answer from someone else here is what I have discovered, I hope it is useful for someone else.

Executive Summary:

  1. Download SSPI enabled curl from http://curl.haxx.se/latest.cgi?curl=win32-ssl changing to Windows, zip, SSL-enabled, SSPI-enabled (7.19.5).
  2. Install Windows Open-SSL from http://www.slproweb.com/products/Win32OpenSSL.html and make a donation to support his bandwidth cost.
  3. Install the Visual C++ 2008 redistributables if you need them.
  4. Use curl to fetch the page: curl.exe -U : --proxy-ntlm --proxy myproxy.com:8080 http://www.google.com

More detailed explanation

The magic phrase for authentication using the Windows login mechanism is SSPI. This gives a good google search phrase. I still haven’t found a good way of using SSPI for HTTP proxy authentication in java or wget though.

However, curl (the download tool) does support SSPI but only in certain builds. Unfortunately the default cygwin build is not one of them. You can find out if your build of curl supports SSPI by getting the verbose version information:

curl -v -V

If SSPI is supported it will be mentioned in the features line.

To get a windows version that supported SSPI I had to go to http://curl.haxx.se/latest.cgi?curl=win32-ssl and then change the download choice to Windows, zip, SSL-enabled, SSPI-enabled (7.19.5). By the time you read this the version number may have changed.

This then silently failed from the command line. When I ran from windows explorer I got a message about a missing libeay32.dll. One way of getting this from windows is from the only link at openssl.org to a windows version. The producer of this requests a donation to cover bandwidth costs. Another way would be to build your own from source.

And after all that curl worked with the following command line:

curl.exe -U : --proxy-ntlm --proxy myproxy.com:8080 http://www.google.com

The -U : configures no password, the other commandline options set up the proxy. You’ll probably have to change your proxy and port settings.

This would all be much easier if only cygwin’s curl release supported SSPI. I’m going to go put in a request for that now.

Leave a Comment