buluma/docker-cntlm repository overview

⁠docker-cntlm

A container to function as a proxy, based on Cntlm⁠. Other containers can link to this one for their web access. This container authenticates to an external proxy and can be used by other containers without authentication details.

              +- - - - - - -+  +- - - - - - - - -+
              | no password |  | password (hash) |
              +- - - - - - -+  +- - - - - - - - -+
                      |              |
+------------------+  V   +-------+  V   +-----------------+      +----------+
| your workstation | ---> | cntlm | ---> | corporate proxy | ---> | internet |
+------------------+      +-------+      +-----------------+      +----------+

⁠Generating a password hash

A password hash needs te be generated once, after which is can be used when running the proxy.

docker run \
  -e "USERNAME=username" \
  -e "DOMAIN=mydomain" \
  -e "PROXY=anything:1234" \
  --rm -it buluma/docker-cntlm -H

Now you have to enter your password (which will not be displayed) and press enter.

Replace:

• username for your own username.
• mydomain for you own domain.

You'll seen output like this:

    Password: 
    PassLM          1AD35398BE6565DDB5C4EF70C0593492
    PassNT          77B9081511704EE852F94227CF48A793
    PassNTLMv2      640937B847F8C6439D87155508FA8479    # Only for user 'username', domain 'mydomain'

⁠Running the proxy

To run the proxy:

• you'll need the PASSNTLMV2 hash generated in the step before.
• you'll also need the proxy to send traffic to.

This is an example of how to run this container.

docker run --restart always --name cntlm \
  -e "USERNAME=username" \
  -e "DOMAIN=mydomain" \
  -e "PASSNTLMV2=640937B847F8C6439D87155508FA8479" \
  -e "PROXY=123.123.123.123:8080" \
  -p 3128:3128 \
  buluma/docker-cntlm

Other settings you might want to use are:

Find technical details here⁠.

⁠Mount custom config

If you want to use an existing cntlm.conf you can mount it directly by settings the CUSTOM_CONFIG environment variable.

docker run --restart always --name cntlm \
  -e "CUSTOM_CONFIG=true" \
  -p 3128:3128 \
  -v /etc/cntlm.conf:/path/to/your/cntlm.conf \
  buluma/docker-cntlm

⁠Using in Docker Compose

You can use this container quite well in a docker-compose. Docker compose can simply be used to run as a stand-alone proxy. In that case the docker-compose.yml simply saves all variable, and can be started by running:

docker-compose up

You can also add the cntlm service in a set of other containers, and let (outgoing) traffic from you application go through the cntlm proxy.