WSL2(Ubuntu)+cntlm 環境でAWS CLIが繋がらない
環境
Windows 10
Ubuntu 22.04
cntlm 0.92.3
aws-cli 2.8.12
Windows 10 でのWSL2(Ubuntu 22.04)からAWS CLIを利用したいのですがプロキシで拒否されてしまいます。
ntlm認証のプロキシを経由するためcntlmをWSLで実行しています。
WSL上からcurlコマンドを実行してhttps://ec2.ap-northeast-1.amazonaws.com/ に繋がることは確認済みです。
また、ホストOSのWindows 10で同様にcntlmを利用してAWS CLIを利用できることも確認済みです。
WSL2(Ubuntu 22.04) のAWS CLIのみ接続できません。
$ sudo service cntlm start
Starting CNTLM Authentication Proxy: cntlm.
$ curl -v https://ec2.ap-northeast-1.amazonaws.com/
* Uses proxy env variable https_proxy == 'http://localhost:3128'
* Trying 127.0.0.1:3128...
* Connected to (nil) (127.0.0.1) port 3128 (#0)
* allocate connect buffer!
* Establish HTTP proxy tunnel to ec2.ap-northeast-1.amazonaws.com:443
> CONNECT ec2.ap-northeast-1.amazonaws.com:443 HTTP/1.1
> Host: ec2.ap-northeast-1.amazonaws.com:443
> User-Agent: curl/7.81.0
> Proxy-Connection: Keep-Alive
>
< HTTP/1.1 200 Connection established
< Connection: close
<
* Proxy replied 200 to CONNECT request
* CONNECT phase completed!
* ALPN, offering h2
* ALPN, offering http/1.1
* CAfile: /etc/ssl/certs/ca-certificates.crt
* CApath: /etc/ssl/certs
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS header, Finished (20):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS header, Finished (20):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN, server accepted to use http/1.1
* Server certificate:
* subject: CN=ec2.ap-northeast-1.amazonaws.com
* start date: Aug 24 00:00:00 2022 GMT
* expire date: Aug 6 23:59:59 2023 GMT
* subjectAltName: host "ec2.ap-northeast-1.amazonaws.com" matched cert's "ec2.ap-northeast-1.amazonaws.com"
* issuer: C=US; O=Amazon; OU=Server CA 1B; CN=Amazon
* SSL certificate verify ok.
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
> GET / HTTP/1.1
> Host: ec2.ap-northeast-1.amazonaws.com
> User-Agent: curl/7.81.0
> Accept: */*
>
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* Mark bundle as not supporting multiuse
< HTTP/1.1 301 Moved Permanently
< Location: https://aws.amazon.com/ec2
< x-amzn-RequestId: f3c63eff-415e-485b-b011-8f416ddaeb7e
< Cache-Control: no-cache, no-store
< Strict-Transport-Security: max-age=31536000; includeSubDomains
< Content-Type: text/xml;charset=UTF-8
< Content-Length: 0
< Date: Thu, 17 Nov 2022 00:22:44 GMT
< Server: AmazonEC2
<
* Connection #0 to host (nil) left intact
$ aws ec2 describe-subnets --debug
2022-11-17 09:27:20,940 - MainThread - awscli.clidriver - DEBUG - CLI version: aws-cli/2.8.12 Python/3.9.11 Linux/5.10.102.1-microsoft-standard-WSL2 exe/x86_64.ubuntu.22
2022-11-17 09:27:20,940 - MainThread - awscli.clidriver - DEBUG - Arguments entered to CLI: ['ec2', 'describe-subnets', '--debug']
2022-11-17 09:27:20,947 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <function add_s3 at 0x7f237dd3d4c0>
...(省略)
POST
/
content-type:application/x-www-form-urlencoded; charset=utf-8
host:ec2.ap-northeast-1.amazonaws.com
x-amz-date:20221117T002721Z
content-type;host;x-amz-date
4458b81adb7ad686766b11e1bb41ad4b186e7cfb44c26a0b7ade703866d0fca0
2022-11-17 09:27:21,055 - MainThread - botocore.auth - DEBUG - StringToSign:
AWS4-HMAC-SHA256
20221117T002721Z
20221117/ap-northeast-1/ec2/aws4_request
40c338695d22e372fd27667e35823acabf118768e60d6c4354f5a5da8fa07565
2022-11-17 09:27:21,055 - MainThread - botocore.auth - DEBUG - Signature:
ae55833f99dd8022dca2852cb052a0238078fcfc839d4f283e8c46f5cce19a52
2022-11-17 09:27:21,055 - MainThread - botocore.endpoint - DEBUG - Sending http request: <AWSPreparedRequest stream_output=False, method=POST, url=https://ec2.ap-northeast-1.amazonaws.com/, headers={'Content-Type': b'application/x-www-form-urlencoded; charset=utf-8', 'User-Agent': b'aws-cli/2.8.12 Python/3.9.11 Linux/5.10.102.1-microsoft-standard-WSL2 exe/x86_64.ubuntu.22 prompt/off command/ec2.describe-subnets', 'X-Amz-Date': b'20221117T002721Z', 'Authorization': b'AWS4-HMAC-SHA256 Credential=AKIAZLX2OK77NU2HFO4E/20221117/ap-northeast-1/ec2/aws4_request, SignedHeaders=content-type;host;x-amz-date, Signature=ae55833f99dd8022dca2852cb052a0238078fcfc839d4f283e8c46f5cce19a52', 'Content-Length': '41'}>
2022-11-17 09:27:21,055 - MainThread - botocore.httpsession - DEBUG - Certificate path: /usr/local/aws-cli/v2/2.8.12/dist/awscli/botocore/cacert.pem
2022-11-17 09:27:21,055 - MainThread - urllib3.connectionpool - DEBUG - Starting new HTTPS connection (1): ec2.ap-northeast-1.amazonaws.com:443
2022-11-17 09:27:21,110 - MainThread - botocore.endpoint - DEBUG - Exception received when sending HTTP request.
Traceback (most recent call last):
File "urllib3/connectionpool.py", line 700, in urlopen
File "urllib3/connectionpool.py", line 996, in _prepare_proxy
File "urllib3/connection.py", line 369, in connect
File "http/client.py", line 930, in _tunnel
OSError: Tunnel connection failed: 407 Proxy Authentication Required
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "awscli/botocore/httpsession.py", line 448, in send
File "urllib3/connectionpool.py", line 787, in urlopen
File "urllib3/util/retry.py", line 525, in increment
File "urllib3/packages/six.py", line 769, in reraise
File "urllib3/connectionpool.py", line 700, in urlopen
File "urllib3/connectionpool.py", line 996, in _prepare_proxy
File "urllib3/connection.py", line 369, in connect
File "http/client.py", line 930, in _tunnel
urllib3.exceptions.ProxyError: ('Cannot connect to proxy.', OSError('Tunnel connection failed: 407 Proxy Authentication Required'))
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "awscli/botocore/endpoint.py", line 199, in _do_get_response
File "awscli/botocore/endpoint.py", line 271, in _send
File "awscli/botocore/httpsession.py", line 479, in send
botocore.exceptions.ProxyConnectionError: Failed to connect to proxy URL: "http://localhost:3128"
2022-11-17 09:27:21,111 - MainThread - botocore.hooks - DEBUG - Event needs-retry.ec2.DescribeSubnets: calling handler <bound method RetryHandler.needs_retry of <botocore.retries.standard.RetryHandler object at 0x7f237afc8520>>
2022-11-17 09:27:21,111 - MainThread - botocore.retries.standard - DEBUG - Retry needed, retrying request after delay of: 0.5989891510469224
2022-11-17 09:27:21,111 - MainThread - botocore.endpoint - DEBUG - Response received to retry, sleeping for 0.5989891510469224 seconds
2022-11-17 09:27:21,711 - MainThread - botocore.hooks - DEBUG - Event request-created.ec2.DescribeSubnets: calling handler <bound method RequestSigner.handler of <botocore.signers.RequestSigner object at 0x7f237b440ac0>>
2022-11-17 09:27:21,712 - MainThread - botocore.hooks - DEBUG - Event choose-signer.ec2.DescribeSubnets: calling handler <function set_operation_specific_signer at 0x7f237f9895e0>
2022-11-17 09:27:21,713 - MainThread - botocore.auth - DEBUG - Calculating signature using v4 auth.
2022-11-17 09:27:21,713 - MainThread - botocore.auth - DEBUG - CanonicalRequest:
...(省略)
Traceback (most recent call last):
File "awscli/botocore/httpsession.py", line 448, in send
File "urllib3/connectionpool.py", line 787, in urlopen
File "urllib3/util/retry.py", line 525, in increment
File "urllib3/packages/six.py", line 769, in reraise
File "urllib3/connectionpool.py", line 700, in urlopen
File "urllib3/connectionpool.py", line 996, in _prepare_proxy
File "urllib3/connection.py", line 369, in connect
File "http/client.py", line 930, in _tunnel
urllib3.exceptions.ProxyError: ('Cannot connect to proxy.', OSError('Tunnel connection failed: 407 Proxy Authentication Required'))
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "awscli/clidriver.py", line 458, in main
File "awscli/clidriver.py", line 593, in __call__
File "awscli/clidriver.py", line 769, in __call__
File "awscli/clidriver.py", line 902, in invoke
File "awscli/clidriver.py", line 924, in _display_response
File "awscli/formatter.py", line 82, in __call__
File "awscli/botocore/paginate.py", line 446, in build_full_result
File "awscli/botocore/paginate.py", line 252, in __iter__
File "awscli/botocore/paginate.py", line 329, in _make_request
File "awscli/botocore/client.py", line 309, in _api_call
File "awscli/botocore/client.py", line 625, in _make_api_call
File "awscli/botocore/client.py", line 645, in _make_request
File "awscli/botocore/endpoint.py", line 101, in make_request
File "awscli/botocore/endpoint.py", line 155, in _send_request
File "awscli/botocore/endpoint.py", line 199, in _do_get_response
File "awscli/botocore/endpoint.py", line 271, in _send
File "awscli/botocore/httpsession.py", line 479, in send
botocore.exceptions.ProxyConnectionError: Failed to connect to proxy URL: "http://localhost:3128"
何か設定が足りないのか、ご教示いただきたいです。