jfxs/alpine-cntlm repository overview

⁠jfxs / alpine-cntlm

A cntlm⁠ Docker image:

• lightweight image based on Alpine Linux only 3 MB,
• multiarch with support of amd64 and arm64,
• non-root container user,
• automatically updated by comparing SBOM changes,
• image signed with Cosign⁠,
• an SBOM attestation added using Syft⁠,
• available on Docker Hub and Quay.io.

The main repository.

The Docker Hub registry.

The Quay.io registry.

⁠Getting Started

⁠Generating your password hash

In order to generate your password hash (-H must be the first argument):

docker run --rm -it jfxs/alpine-cntlm -H -u <username> -d <domain> <proxy_host>:<proxy_port>

Enter your password (not displayed) and press enter.

PassLM          8B536635BF212BDF23E58C193159813A
PassNT          CA739B6BCB33AEB40B377AA52DD37D94
PassNTLMv2      82C73BA04D05533DD9BD9B3930B41977    # Only for user ...

⁠Running the cntlm proxy

Get the PassNTLMv2 hash generated previously and run:

docker run -d --rm --name proxy -p 3128:3128 jfxs/alpine-cntlm  \
-u <username> -p 82C73BA04D05533DD9BD9B3930B41977 -d <domain> <proxy_host>:<proxy_port>

If necessary, the corporate DNS servers can be set-up:

docker run -d --rm --name proxy --dns 10.x.y.z --dns 10.u.v.w -p 3128:3128 jfxs/alpine-cntlm ...

⁠Arguments and options of cntlm

⁠Built with

Docker latest tag is 3.24.1-001, 3.24, 3⁠ and contains:

Details are updated on Dockerhub Overview page⁠ when an image is published.

⁠Versioning

The Docker tag is defined by the alpine version used and an increment to differentiate build with the same alpine version:

<alpine_version>-<increment>

Example: 3.16.3-1

⁠Signature and attestation

Cosign⁠ public key:

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEa3yV6+yd/l4zh/tfT6Tx+zn0dhy3
BhFqSad1norLeKSCN2MILv4fZ9GA6ODOlJOw+7vzUvzZVr9IXnxEdjoWJw==
-----END PUBLIC KEY-----

The public key is also available online: https://gitlab.com/op_so/docker/cosign-public-key/-/raw/main/cosign.pub⁠.

To verify an image:

cosign verify --key cosign.pub $IMAGE_URI

To verify and get the SBOM attestation:

cosign verify-attestation --key cosign.pub --type spdxjson $IMAGE_URI | jq '.payload | @base64d | fromjson | .predicate'

⁠Authors

• FX Soubirou - Initial work - GitLab repositories⁠

⁠License

This program is free software: you can redistribute it and/or modify it under the terms of the MIT License (MIT). See the LICENSE⁠ for details.