Does git clone work through NTLM proxies?

user_209486 0
Viewed 30302

I've tried both using export http_proxy=http://[username]:[pwd]@[proxy] and git config --global http.proxy http://[username]:[pwd]@[proxy].

I couldn't make it work. It looks like git uses Basic authentication:

Initialized empty Git repository in /home/.../.git/
* Couldn't find host github.com in the .netrc file, using defaults
* About to connect() to github.com port 8080 (#0)
*   Trying 10.... * Connected to github.com (10....) port 8080 (#0)
* Proxy auth using Basic with user '...'
> GET http://github.com/sunlightlabs/fiftystates.git/info/refs HTTP/1.1
Proxy-Authorization: Basic MD...
User-Agent: git/1.6.1.2
Host: github.com
Pragma: no-cache
Accept: */*
Proxy-Connection: Keep-Alive

< HTTP/1.1 407 Proxy Authentication Required ( The ISA Server requires authorization to fulfill the request. Access to t
he Web Proxy filter is denied.  )
< Via: 1.1 ...
< Proxy-Authenticate: Negotiate
< Proxy-Authenticate: Kerberos
< Proxy-Authenticate: NTLM
< Connection: Keep-Alive
< Proxy-Connection: Keep-Alive
< Pragma: no-cache
< Cache-Control: no-cache
< Content-Type: text/html
< Content-Length: 4118
* The requested URL returned error: 407
* Closing connection #0
fatal: http://github.com/sunlightlabs/fiftystates.git/info/refs download error - The requested URL returned error: 407

Google search returned mixed and probably not updated results. Somewhere it says that curl is (was?) used under the hood, but its options are (were?) hardwired into code. For example, 

curl --proxy-ntlm --proxy ...:8080 google.com

works, and I'd like to use the same option with git.

I need some more definite answers here: has anybody succeed using git through Windows proxies? Which version?

Thanks.

ntlm curl proxy git
9 Answers

You can also use cntlm,

http://cntlm.sourceforge.net/

A solution similar to ntlmaps but written in pure C. It works in the same way as ntlmaps by creating a local proxy server (127.0.0.1) at a port (3128 default) on your machine. This new locally created proxy server does not require any authentication and thus can be used with any application that supports http proxy. It can also create a local socks proxy if you need one.

The main advantage over ntlmaps which is written in python, is that cntlm has very low CPU and RAM usage, typically <2%.

user_3252840

TL/DR: 

export GIT_HTTP_PROXY_AUTHMETHOD=basic

or

git config --global http.proxyauthmethod basic

I had the same issue when git (curl) proxy auth did not work. Credentials were right. Upgrade to the latest git-v2.15.0 did not help.

The issue was due to wrong proxy authentication method chosen by git-libcurl.

The valid proxy_authmethod options are defined in git source: https://github.com/git/git/blob/d0e9983980a25e0c398cc03342e5ad22ef85b8a8/http.c#L81

The proxyauthmethod can be defined either through GIT_HTTP_PROXY_AUTHMETHOD environment variable or http.proxyauthmethod git config option. Environment variable overrides the config option value.

user_41532470

I have stumbled on a more easier and possibly safer solution that works not just for git but also any command based installers

  • Rubygems in ruby
  • npm in node

One solution running all your traffic from command line is proxied with authentiction.

Wont expose your password in the user:password@domain:port format

Solution:

Download Fiddler, It has a built in way to add authentication headers to all requests.

Once running menu Rules-> Automatically Authenticate (Tick that)

Then for git

git config --global http.proxy http://localhost:8888
git config --global https.proxy http://localhost:8888

Thats it!

user_3807330
Related