

WSL2(Ubuntu)+cntlm 環境でAWS CLIが繋がらない

環境  
Windows 10  
Ubuntu 22.04  
cntlm 0.92.3  
aws-cli 2.8.12

Windows 10 でのWSL2(Ubuntu 22.04)からAWS CLIを利用したいのですがプロキシで拒否されてしまいます。  
ntlm認証のプロキシを経由するためcntlmをWSLで実行しています。  
WSL上からcurlコマンドを実行してhttps://ec2.ap-northeast-1.amazonaws.com/ に繋がることは確認済みです。  
また、ホストOSのWindows 10で同様にcntlmを利用してAWS CLIを利用できることも確認済みです。  
WSL2(Ubuntu 22.04) のAWS CLIのみ接続できません。

[code]

    $ sudo service cntlm start
    Starting CNTLM Authentication Proxy: cntlm.
    $ curl -v https://ec2.ap-northeast-1.amazonaws.com/
    * Uses proxy env variable https_proxy == 'http://localhost:3128'
    *   Trying 127.0.0.1:3128...
    * Connected to (nil) (127.0.0.1) port 3128 (#0)
    * allocate connect buffer!
    * Establish HTTP proxy tunnel to ec2.ap-northeast-1.amazonaws.com:443
    > CONNECT ec2.ap-northeast-1.amazonaws.com:443 HTTP/1.1
    > Host: ec2.ap-northeast-1.amazonaws.com:443
    > User-Agent: curl/7.81.0
    > Proxy-Connection: Keep-Alive
    >
    < HTTP/1.1 200 Connection established
    < Connection: close
    <
    * Proxy replied 200 to CONNECT request
    * CONNECT phase completed!
    * ALPN, offering h2
    * ALPN, offering http/1.1
    *  CAfile: /etc/ssl/certs/ca-certificates.crt
    *  CApath: /etc/ssl/certs
    * TLSv1.0 (OUT), TLS header, Certificate Status (22):
    * TLSv1.3 (OUT), TLS handshake, Client hello (1):
    * TLSv1.2 (IN), TLS header, Certificate Status (22):
    * TLSv1.3 (IN), TLS handshake, Server hello (2):
    * TLSv1.2 (IN), TLS header, Certificate Status (22):
    * TLSv1.2 (IN), TLS handshake, Certificate (11):
    * TLSv1.2 (IN), TLS header, Certificate Status (22):
    * TLSv1.2 (IN), TLS handshake, Server key exchange (12):
    * TLSv1.2 (IN), TLS header, Certificate Status (22):
    * TLSv1.2 (IN), TLS handshake, Server finished (14):
    * TLSv1.2 (OUT), TLS header, Certificate Status (22):
    * TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
    * TLSv1.2 (OUT), TLS header, Finished (20):
    * TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
    * TLSv1.2 (OUT), TLS header, Certificate Status (22):
    * TLSv1.2 (OUT), TLS handshake, Finished (20):
    * TLSv1.2 (IN), TLS header, Finished (20):
    * TLSv1.2 (IN), TLS header, Certificate Status (22):
    * TLSv1.2 (IN), TLS handshake, Finished (20):
    * SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
    * ALPN, server accepted to use http/1.1
    * Server certificate:
    *  subject: CN=ec2.ap-northeast-1.amazonaws.com
    *  start date: Aug 24 00:00:00 2022 GMT
    *  expire date: Aug  6 23:59:59 2023 GMT
    *  subjectAltName: host "ec2.ap-northeast-1.amazonaws.com" matched cert's "ec2.ap-northeast-1.amazonaws.com"
    *  issuer: C=US; O=Amazon; OU=Server CA 1B; CN=Amazon
    *  SSL certificate verify ok.
    * TLSv1.2 (OUT), TLS header, Supplemental data (23):
    > GET / HTTP/1.1
    > Host: ec2.ap-northeast-1.amazonaws.com
    > User-Agent: curl/7.81.0
    > Accept: */*
    >
    * TLSv1.2 (IN), TLS header, Supplemental data (23):
    * Mark bundle as not supporting multiuse
    < HTTP/1.1 301 Moved Permanently
    < Location: https://aws.amazon.com/ec2
    < x-amzn-RequestId: f3c63eff-415e-485b-b011-8f416ddaeb7e
    < Cache-Control: no-cache, no-store
    < Strict-Transport-Security: max-age=31536000; includeSubDomains
    < Content-Type: text/xml;charset=UTF-8
    < Content-Length: 0
    < Date: Thu, 17 Nov 2022 00:22:44 GMT
    < Server: AmazonEC2
    <
    * Connection #0 to host (nil) left intact
    
    $ aws ec2 describe-subnets --debug
    2022-11-17 09:27:20,940 - MainThread - awscli.clidriver - DEBUG - CLI version: aws-cli/2.8.12 Python/3.9.11 Linux/5.10.102.1-microsoft-standard-WSL2 exe/x86_64.ubuntu.22
    2022-11-17 09:27:20,940 - MainThread - awscli.clidriver - DEBUG - Arguments entered to CLI: ['ec2', 'describe-subnets', '--debug']
    2022-11-17 09:27:20,947 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <function add_s3 at 0x7f237dd3d4c0>
    ...(省略)
    POST
    /
    
    content-type:application/x-www-form-urlencoded; charset=utf-8
    host:ec2.ap-northeast-1.amazonaws.com
    x-amz-date:20221117T002721Z
    
    content-type;host;x-amz-date
    4458b81adb7ad686766b11e1bb41ad4b186e7cfb44c26a0b7ade703866d0fca0
    2022-11-17 09:27:21,055 - MainThread - botocore.auth - DEBUG - StringToSign:
    AWS4-HMAC-SHA256
    20221117T002721Z
    20221117/ap-northeast-1/ec2/aws4_request
    40c338695d22e372fd27667e35823acabf118768e60d6c4354f5a5da8fa07565
    2022-11-17 09:27:21,055 - MainThread - botocore.auth - DEBUG - Signature:
    ae55833f99dd8022dca2852cb052a0238078fcfc839d4f283e8c46f5cce19a52
    2022-11-17 09:27:21,055 - MainThread - botocore.endpoint - DEBUG - Sending http request: <AWSPreparedRequest stream_output=False, method=POST, url=https://ec2.ap-northeast-1.amazonaws.com/, headers={'Content-Type': b'application/x-www-form-urlencoded; charset=utf-8', 'User-Agent': b'aws-cli/2.8.12 Python/3.9.11 Linux/5.10.102.1-microsoft-standard-WSL2 exe/x86_64.ubuntu.22 prompt/off command/ec2.describe-subnets', 'X-Amz-Date': b'20221117T002721Z', 'Authorization': b'AWS4-HMAC-SHA256 Credential=AKIAZLX2OK77NU2HFO4E/20221117/ap-northeast-1/ec2/aws4_request, SignedHeaders=content-type;host;x-amz-date, Signature=ae55833f99dd8022dca2852cb052a0238078fcfc839d4f283e8c46f5cce19a52', 'Content-Length': '41'}>
    2022-11-17 09:27:21,055 - MainThread - botocore.httpsession - DEBUG - Certificate path: /usr/local/aws-cli/v2/2.8.12/dist/awscli/botocore/cacert.pem
    2022-11-17 09:27:21,055 - MainThread - urllib3.connectionpool - DEBUG - Starting new HTTPS connection (1): ec2.ap-northeast-1.amazonaws.com:443
    2022-11-17 09:27:21,110 - MainThread - botocore.endpoint - DEBUG - Exception received when sending HTTP request.
    Traceback (most recent call last):
      File "urllib3/connectionpool.py", line 700, in urlopen
      File "urllib3/connectionpool.py", line 996, in _prepare_proxy
      File "urllib3/connection.py", line 369, in connect
      File "http/client.py", line 930, in _tunnel
    OSError: Tunnel connection failed: 407 Proxy Authentication Required
    
    During handling of the above exception, another exception occurred:
    
    Traceback (most recent call last):
      File "awscli/botocore/httpsession.py", line 448, in send
      File "urllib3/connectionpool.py", line 787, in urlopen
      File "urllib3/util/retry.py", line 525, in increment
      File "urllib3/packages/six.py", line 769, in reraise
      File "urllib3/connectionpool.py", line 700, in urlopen
      File "urllib3/connectionpool.py", line 996, in _prepare_proxy
      File "urllib3/connection.py", line 369, in connect
      File "http/client.py", line 930, in _tunnel
    urllib3.exceptions.ProxyError: ('Cannot connect to proxy.', OSError('Tunnel connection failed: 407 Proxy Authentication Required'))
    
    During handling of the above exception, another exception occurred:
    
    Traceback (most recent call last):
      File "awscli/botocore/endpoint.py", line 199, in _do_get_response
      File "awscli/botocore/endpoint.py", line 271, in _send
      File "awscli/botocore/httpsession.py", line 479, in send
    botocore.exceptions.ProxyConnectionError: Failed to connect to proxy URL: "http://localhost:3128"
    2022-11-17 09:27:21,111 - MainThread - botocore.hooks - DEBUG - Event needs-retry.ec2.DescribeSubnets: calling handler <bound method RetryHandler.needs_retry of <botocore.retries.standard.RetryHandler object at 0x7f237afc8520>>
    2022-11-17 09:27:21,111 - MainThread - botocore.retries.standard - DEBUG - Retry needed, retrying request after delay of: 0.5989891510469224
    2022-11-17 09:27:21,111 - MainThread - botocore.endpoint - DEBUG - Response received to retry, sleeping for 0.5989891510469224 seconds
    2022-11-17 09:27:21,711 - MainThread - botocore.hooks - DEBUG - Event request-created.ec2.DescribeSubnets: calling handler <bound method RequestSigner.handler of <botocore.signers.RequestSigner object at 0x7f237b440ac0>>
    2022-11-17 09:27:21,712 - MainThread - botocore.hooks - DEBUG - Event choose-signer.ec2.DescribeSubnets: calling handler <function set_operation_specific_signer at 0x7f237f9895e0>
    2022-11-17 09:27:21,713 - MainThread - botocore.auth - DEBUG - Calculating signature using v4 auth.
    2022-11-17 09:27:21,713 - MainThread - botocore.auth - DEBUG - CanonicalRequest:
    ...(省略)
    
    Traceback (most recent call last):
      File "awscli/botocore/httpsession.py", line 448, in send
      File "urllib3/connectionpool.py", line 787, in urlopen
      File "urllib3/util/retry.py", line 525, in increment
      File "urllib3/packages/six.py", line 769, in reraise
      File "urllib3/connectionpool.py", line 700, in urlopen
      File "urllib3/connectionpool.py", line 996, in _prepare_proxy
      File "urllib3/connection.py", line 369, in connect
      File "http/client.py", line 930, in _tunnel
    urllib3.exceptions.ProxyError: ('Cannot connect to proxy.', OSError('Tunnel connection failed: 407 Proxy Authentication Required'))
    
    During handling of the above exception, another exception occurred:
    
    Traceback (most recent call last):
      File "awscli/clidriver.py", line 458, in main
      File "awscli/clidriver.py", line 593, in __call__
      File "awscli/clidriver.py", line 769, in __call__
      File "awscli/clidriver.py", line 902, in invoke
      File "awscli/clidriver.py", line 924, in _display_response
      File "awscli/formatter.py", line 82, in __call__
      File "awscli/botocore/paginate.py", line 446, in build_full_result
      File "awscli/botocore/paginate.py", line 252, in __iter__
      File "awscli/botocore/paginate.py", line 329, in _make_request
      File "awscli/botocore/client.py", line 309, in _api_call
      File "awscli/botocore/client.py", line 625, in _make_api_call
      File "awscli/botocore/client.py", line 645, in _make_request
      File "awscli/botocore/endpoint.py", line 101, in make_request
      File "awscli/botocore/endpoint.py", line 155, in _send_request
      File "awscli/botocore/endpoint.py", line 199, in _do_get_response
      File "awscli/botocore/endpoint.py", line 271, in _send
      File "awscli/botocore/httpsession.py", line 479, in send
    botocore.exceptions.ProxyConnectionError: Failed to connect to proxy URL: "http://localhost:3128"
    
[/code]

何か設定が足りないのか、ご教示いただきたいです。


CC BY-SA 4.0
2022-11-15T09:24:24.213
92243
2022-11-17T00:45:05.460
2022-11-17T00:45:05.460
55407
55407
question
wsl aws-cli
WSL2(Ubuntu)+cntlm 環境でAWS CLIが繋がらない


AWS CLIではNTLMプロキシがサポートされていないようです。  
[AWS Command Line Interface - HTTP プロキシを使用する -
プロキシを認証する](https://docs.aws.amazon.com/ja_jp/cli/latest/userguide/cli-
configure-proxy.html)

[code]

    $ export HTTP_PROXY=http://10.15.20.25:1234
    $ export HTTP_PROXY=http://proxy.example.com:1234
    $ export HTTPS_PROXY=http://10.15.20.25:5678
    $ export HTTPS_PROXY=http://proxy.example.com:5678
    
[/code]

の例の下に以下の記事があります。

> AWS CLI では NTLM プロキシはサポートされていません。NTLM または Kerberos  
>  プロトコルプロキシを使用する場合は、Cntlm などの認証プロキシを介して接続できることがあります。

UbuntuでCntlmを使えば接続できるかもしれませんが、  
**プロキシ経由ということは企業、学校などの環境からつなげるのだと推測します。  
プロキシをかいくぐることになるため、組織のセキュリティ部門とCntlmの利用について相談することをお勧めします。**

[Cntlmを使ってNTLMv2認証Proxy環境をやっつける](https://qiita.com/yohskeey/items/6f17ea051fbe5568f3bf)


CC BY-SA 4.0
2022-11-15T10:33:15.850
92246
2022-11-16T00:11:54.957
2022-11-16T00:11:54.957
35558
35558
92243
answer


> 同環境でcurlコマンドを実行してhttps://ec2.ap-northeast-1.amazonaws.com/ に繋がることは確認済みです。

とのことで、具体的な手順が開示されていないのでわかりませんが、同じ設定をすればいいのではないでしょうか。

> OSError: Tunnel connection failed: 407 Proxy Authentication Required

と言っていますのでProxy認証情報が必要です。curlにはどのように渡したのでしょうか？

[AWS Command Line Interface - HTTP プロキシを使用する -
プロキシを認証する](https://docs.aws.amazon.com/ja_jp/cli/latest/userguide/cli-
configure-proxy.html#cli-configure-proxy-auth)には

[code]

    $ export HTTP_PROXY=http://username:password@proxy.example.com:1234
    $ export HTTPS_PROXY=http://username:password@proxy.example.com:5678
    
[/code]

という例が載っています。


CC BY-SA 4.0
2022-11-15T22:21:21.570
92248
2022-11-15T22:21:21.570
4236
92243
answer