0

WSL2(Ubuntu)+cntlm 環境でAWS CLIが繋がらない

環境
Windows 10
Ubuntu 22.04
cntlm 0.92.3
aws-cli 2.8.12

Windows 10 でのWSL2(Ubuntu 22.04)からAWS CLIを利用したいのですがプロキシで拒否されてしまいます。
ntlm認証のプロキシを経由するためcntlmをWSLで実行しています。
WSL上からcurlコマンドを実行してhttps://ec2.ap-northeast-1.amazonaws.com/ に繋がることは確認済みです。
また、ホストOSのWindows 10で同様にcntlmを利用してAWS CLIを利用できることも確認済みです。
WSL2(Ubuntu 22.04) のAWS CLIのみ接続できません。

$ sudo service cntlm start
Starting CNTLM Authentication Proxy: cntlm.
$ curl -v https://ec2.ap-northeast-1.amazonaws.com/
* Uses proxy env variable https_proxy == 'http://localhost:3128'
*   Trying 127.0.0.1:3128...
* Connected to (nil) (127.0.0.1) port 3128 (#0)
* allocate connect buffer!
* Establish HTTP proxy tunnel to ec2.ap-northeast-1.amazonaws.com:443
> CONNECT ec2.ap-northeast-1.amazonaws.com:443 HTTP/1.1
> Host: ec2.ap-northeast-1.amazonaws.com:443
> User-Agent: curl/7.81.0
> Proxy-Connection: Keep-Alive
>
< HTTP/1.1 200 Connection established
< Connection: close
<
* Proxy replied 200 to CONNECT request
* CONNECT phase completed!
* ALPN, offering h2
* ALPN, offering http/1.1
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS header, Finished (20):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS header, Finished (20):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: CN=ec2.ap-northeast-1.amazonaws.com
*  start date: Aug 24 00:00:00 2022 GMT
*  expire date: Aug  6 23:59:59 2023 GMT
*  subjectAltName: host "ec2.ap-northeast-1.amazonaws.com" matched cert's "ec2.ap-northeast-1.amazonaws.com"
*  issuer: C=US; O=Amazon; OU=Server CA 1B; CN=Amazon
*  SSL certificate verify ok.
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
> GET / HTTP/1.1
> Host: ec2.ap-northeast-1.amazonaws.com
> User-Agent: curl/7.81.0
> Accept: */*
>
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* Mark bundle as not supporting multiuse
< HTTP/1.1 301 Moved Permanently
< Location: https://aws.amazon.com/ec2
< x-amzn-RequestId: f3c63eff-415e-485b-b011-8f416ddaeb7e
< Cache-Control: no-cache, no-store
< Strict-Transport-Security: max-age=31536000; includeSubDomains
< Content-Type: text/xml;charset=UTF-8
< Content-Length: 0
< Date: Thu, 17 Nov 2022 00:22:44 GMT
< Server: AmazonEC2
<
* Connection #0 to host (nil) left intact

$ aws ec2 describe-subnets --debug
2022-11-17 09:27:20,940 - MainThread - awscli.clidriver - DEBUG - CLI version: aws-cli/2.8.12 Python/3.9.11 Linux/5.10.102.1-microsoft-standard-WSL2 exe/x86_64.ubuntu.22
2022-11-17 09:27:20,940 - MainThread - awscli.clidriver - DEBUG - Arguments entered to CLI: ['ec2', 'describe-subnets', '--debug']
2022-11-17 09:27:20,947 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <function add_s3 at 0x7f237dd3d4c0>
...(省略)
POST
/

content-type:application/x-www-form-urlencoded; charset=utf-8
host:ec2.ap-northeast-1.amazonaws.com
x-amz-date:20221117T002721Z

content-type;host;x-amz-date
4458b81adb7ad686766b11e1bb41ad4b186e7cfb44c26a0b7ade703866d0fca0
2022-11-17 09:27:21,055 - MainThread - botocore.auth - DEBUG - StringToSign:
AWS4-HMAC-SHA256
20221117T002721Z
20221117/ap-northeast-1/ec2/aws4_request
40c338695d22e372fd27667e35823acabf118768e60d6c4354f5a5da8fa07565
2022-11-17 09:27:21,055 - MainThread - botocore.auth - DEBUG - Signature:
ae55833f99dd8022dca2852cb052a0238078fcfc839d4f283e8c46f5cce19a52
2022-11-17 09:27:21,055 - MainThread - botocore.endpoint - DEBUG - Sending http request: <AWSPreparedRequest stream_output=False, method=POST, url=https://ec2.ap-northeast-1.amazonaws.com/, headers={'Content-Type': b'application/x-www-form-urlencoded; charset=utf-8', 'User-Agent': b'aws-cli/2.8.12 Python/3.9.11 Linux/5.10.102.1-microsoft-standard-WSL2 exe/x86_64.ubuntu.22 prompt/off command/ec2.describe-subnets', 'X-Amz-Date': b'20221117T002721Z', 'Authorization': b'AWS4-HMAC-SHA256 Credential=AKIAZLX2OK77NU2HFO4E/20221117/ap-northeast-1/ec2/aws4_request, SignedHeaders=content-type;host;x-amz-date, Signature=ae55833f99dd8022dca2852cb052a0238078fcfc839d4f283e8c46f5cce19a52', 'Content-Length': '41'}>
2022-11-17 09:27:21,055 - MainThread - botocore.httpsession - DEBUG - Certificate path: /usr/local/aws-cli/v2/2.8.12/dist/awscli/botocore/cacert.pem
2022-11-17 09:27:21,055 - MainThread - urllib3.connectionpool - DEBUG - Starting new HTTPS connection (1): ec2.ap-northeast-1.amazonaws.com:443
2022-11-17 09:27:21,110 - MainThread - botocore.endpoint - DEBUG - Exception received when sending HTTP request.
Traceback (most recent call last):
  File "urllib3/connectionpool.py", line 700, in urlopen
  File "urllib3/connectionpool.py", line 996, in _prepare_proxy
  File "urllib3/connection.py", line 369, in connect
  File "http/client.py", line 930, in _tunnel
OSError: Tunnel connection failed: 407 Proxy Authentication Required

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "awscli/botocore/httpsession.py", line 448, in send
  File "urllib3/connectionpool.py", line 787, in urlopen
  File "urllib3/util/retry.py", line 525, in increment
  File "urllib3/packages/six.py", line 769, in reraise
  File "urllib3/connectionpool.py", line 700, in urlopen
  File "urllib3/connectionpool.py", line 996, in _prepare_proxy
  File "urllib3/connection.py", line 369, in connect
  File "http/client.py", line 930, in _tunnel
urllib3.exceptions.ProxyError: ('Cannot connect to proxy.', OSError('Tunnel connection failed: 407 Proxy Authentication Required'))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "awscli/botocore/endpoint.py", line 199, in _do_get_response
  File "awscli/botocore/endpoint.py", line 271, in _send
  File "awscli/botocore/httpsession.py", line 479, in send
botocore.exceptions.ProxyConnectionError: Failed to connect to proxy URL: "http://localhost:3128"
2022-11-17 09:27:21,111 - MainThread - botocore.hooks - DEBUG - Event needs-retry.ec2.DescribeSubnets: calling handler <bound method RetryHandler.needs_retry of <botocore.retries.standard.RetryHandler object at 0x7f237afc8520>>
2022-11-17 09:27:21,111 - MainThread - botocore.retries.standard - DEBUG - Retry needed, retrying request after delay of: 0.5989891510469224
2022-11-17 09:27:21,111 - MainThread - botocore.endpoint - DEBUG - Response received to retry, sleeping for 0.5989891510469224 seconds
2022-11-17 09:27:21,711 - MainThread - botocore.hooks - DEBUG - Event request-created.ec2.DescribeSubnets: calling handler <bound method RequestSigner.handler of <botocore.signers.RequestSigner object at 0x7f237b440ac0>>
2022-11-17 09:27:21,712 - MainThread - botocore.hooks - DEBUG - Event choose-signer.ec2.DescribeSubnets: calling handler <function set_operation_specific_signer at 0x7f237f9895e0>
2022-11-17 09:27:21,713 - MainThread - botocore.auth - DEBUG - Calculating signature using v4 auth.
2022-11-17 09:27:21,713 - MainThread - botocore.auth - DEBUG - CanonicalRequest:
...(省略)

Traceback (most recent call last):
  File "awscli/botocore/httpsession.py", line 448, in send
  File "urllib3/connectionpool.py", line 787, in urlopen
  File "urllib3/util/retry.py", line 525, in increment
  File "urllib3/packages/six.py", line 769, in reraise
  File "urllib3/connectionpool.py", line 700, in urlopen
  File "urllib3/connectionpool.py", line 996, in _prepare_proxy
  File "urllib3/connection.py", line 369, in connect
  File "http/client.py", line 930, in _tunnel
urllib3.exceptions.ProxyError: ('Cannot connect to proxy.', OSError('Tunnel connection failed: 407 Proxy Authentication Required'))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "awscli/clidriver.py", line 458, in main
  File "awscli/clidriver.py", line 593, in __call__
  File "awscli/clidriver.py", line 769, in __call__
  File "awscli/clidriver.py", line 902, in invoke
  File "awscli/clidriver.py", line 924, in _display_response
  File "awscli/formatter.py", line 82, in __call__
  File "awscli/botocore/paginate.py", line 446, in build_full_result
  File "awscli/botocore/paginate.py", line 252, in __iter__
  File "awscli/botocore/paginate.py", line 329, in _make_request
  File "awscli/botocore/client.py", line 309, in _api_call
  File "awscli/botocore/client.py", line 625, in _make_api_call
  File "awscli/botocore/client.py", line 645, in _make_request
  File "awscli/botocore/endpoint.py", line 101, in make_request
  File "awscli/botocore/endpoint.py", line 155, in _send_request
  File "awscli/botocore/endpoint.py", line 199, in _do_get_response
  File "awscli/botocore/endpoint.py", line 271, in _send
  File "awscli/botocore/httpsession.py", line 479, in send
botocore.exceptions.ProxyConnectionError: Failed to connect to proxy URL: "http://localhost:3128"

何か設定が足りないのか、ご教示いただきたいです。

1
  • 「同環境でcurlコマンド」の同環境とは、WSL+ホスト上のcntml経由での接続、という意味ですか?それともcurlで直接proxyに接続したのでしょうか。質問を編集してこのあたり明確にしてください
    – suzukis
    Commented 2022年11月16日 13:57

2 件の回答 2

-1

同環境でcurlコマンドを実行してhttps://ec2.ap-northeast-1.amazonaws.com/ に繋がることは確認済みです。

とのことで、具体的な手順が開示されていないのでわかりませんが、同じ設定をすればいいのではないでしょうか。

OSError: Tunnel connection failed: 407 Proxy Authentication Required

と言っていますのでProxy認証情報が必要です。curlにはどのように渡したのでしょうか?

AWS Command Line Interface - HTTP プロキシを使用する - プロキシを認証するには

$ export HTTP_PROXY=http://username:[email protected]:1234
$ export HTTPS_PROXY=http://username:[email protected]:5678

という例が載っています。

1
  • ubuntu上でcntlmを立ち上げ、以下でcntlmを通るように設定しています。 export http_proxy=localhost:3128 export https_proxy=localhost:3128 ログを見る限り一応認識されているようです。
    – CCPSY
    Commented 2022年11月17日 1:18
-1

AWS CLIではNTLMプロキシがサポートされていないようです。
AWS Command Line Interface - HTTP プロキシを使用する - プロキシを認証する

$ export HTTP_PROXY=http://10.15.20.25:1234
$ export HTTP_PROXY=http://proxy.example.com:1234
$ export HTTPS_PROXY=http://10.15.20.25:5678
$ export HTTPS_PROXY=http://proxy.example.com:5678

の例の下に以下の記事があります。

AWS CLI では NTLM プロキシはサポートされていません。NTLM または Kerberos
プロトコルプロキシを使用する場合は、Cntlm などの認証プロキシを介して接続できることがあります。

UbuntuでCntlmを使えば接続できるかもしれませんが、
プロキシ経由ということは企業、学校などの環境からつなげるのだと推測します。
プロキシをかいくぐることになるため、組織のセキュリティ部門とCntlmの利用について相談することをお勧めします。

Cntlmを使ってNTLMv2認証Proxy環境をやっつける

1
  • 社内でWindows用の手順書が配布されていたので同じようにWSLでも、と思って試したところでした。セキュリティ部門、ネットワーク部門に相談してみます。
    – CCPSY
    Commented 2022年11月17日 1:20

この質問に回答するには、ログインする必要があります。

求めていた回答ではありませんか? のタグが付いた他の質問を参照する。