如何在Kerberos认证的Squid企业代理下使用直连应用

Hey there, I’ve dealt with exactly this scenario before—when a corporate proxy switches to Kerberos, all those old apps that only do basic auth or hardcode direct connections break hard. Let’s walk through the most reliable fixes:

1. Use Cntlm as a Kerberos-to-Basic Auth Proxy Middleman #

Cntlm acts as a local proxy that handles the Kerberos authentication with your Squid server, then lets your legacy apps connect to it using basic auth (or even no auth, if you configure it that way). Here’s how to set it up:

• Install Cntlm on your machine (it’s cross-platform, works on Windows, macOS, Linux)
• Edit the cntlm.conf file to point to your corporate proxy:

  Username your-domain-username
  Domain YOUR_COMPANY_DOMAIN
  Proxy corporate-proxy.example.com:8080  # Your Squid proxy address
  Auth Kerberos5
  Listen 127.0.0.1:3128  # Local port for your apps to connect to
  

• Validate the configuration and get a Kerberos ticket:
  Run cntlm -c /path/to/cntlm.conf -I -M http://google.com—this will test the connection and generate any necessary hashes (add them to your conf file if prompted)
• Restart Cntlm, then set all your non-Kerberos apps to use 127.0.0.1:3128 as their proxy (with basic auth if you enabled it, or just leave credentials blank if you configured Cntlm to handle it)

2. Force Direct-Connect Apps Through the Proxy #

For apps that ignore system proxy settings and try to connect directly:

• Use Cntlm’s built-in PAC file support, or set your system’s global proxy to 127.0.0.1:3128—this will catch most traffic
• If that doesn’t work, pair Cntlm with Proxifier again: Configure Proxifier to route all app traffic to 127.0.0.1:3128 instead of the corporate proxy directly. Proxifier handles the traffic redirection, while Cntlm takes care of the Kerberos heavy lifting.

3. Alternative: Nginx as a Kerberos Reverse Proxy (For Advanced Users) #

If you prefer a more customizable setup, you can use Nginx with the ngx_http_auth_kerb_module to act as the middleman. This requires compiling Nginx with the module or using a pre-built package that includes it. The core idea is similar to Cntlm: Nginx authenticates with Kerberos to the Squid proxy, then exposes a local proxy endpoint for your apps.

Key Notes to Avoid Headaches #

• Make sure your machine is joined to the corporate domain and has valid Kerberos configuration (check krb5.conf on Linux/macOS, or use the domain join tools on Windows)
• Always test the local proxy first (e.g., use curl --proxy 127.0.0.1:3128 http://google.com) before configuring apps
• For some stubborn apps, you might need to use tools like proxychains (Linux/macOS) to force their traffic through the local proxy

内容的提问来源于stack exchange，提问作者Eilder Jorge