Breaking through the ISA Barrier
Posted by pedxing on Fri 17 Feb 2006 at 10:41
Microsoft ISA Server is a common proxy server within Windows-based networks. It is not very Linux friendly. NTLM Authorization Proxy Server helps us out with this.
My office is nearly exclusively MS, the ISA server is the only gateway to the internet from the LAN. I installed Debian on one machine from the netinst CD on an external network, then hooked it up to the LAN.
`apt-setup` will let you set your proxy server, but no amount of coaxing, cursing, or brute force would make ISA accept a connection from the Debian box. After a quick search, I found NTLMaps. It is a python-based proxy which runs on localhost, and redirects to the ISA server, providing the required interfaces on both ends.
`apt-get install ntlmaps` will grab it, and step you through a few basic questions... Local Port, ISA Server, ISA Port, Domain, Username, Password.
Once it's running, simply run apt-setup and tell it to use localhost:5865 as the proxy, and you're apt-getting before you know it. This will also work with web browsers, elinks can be configured by editing /etc/elinks/elinks.conf and editing the proxy line to read: 'set protocol.http.proxy.host = "localhost:5865"'.
If you need to change the proxy settings, you can `dpkg-reconfigure ntlmaps`, to change apt's proxy settings, you can edit /etc/apt/apt.conf.
[ Parent | Reply to this comment ]
Alternatively IIRC you can specify static IPs that are just allowed through the ISA server without having to auth.
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
There are plenty of good firewalls, some of them even use Linux, but unless PIX has made huge strides recently, it isn't one of them.
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
I am not a fan of ISA, I've used squid in the past, but it's not my place to run the proxies.
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
I also had to edit the Debian supplied configuration as it rewrites the http headers in order to pretend the browser is some version of IE. This prevents some sites like Google maps from working with all features as it thinks that your browser is not good enough.
[ Parent | Reply to this comment ]