Hugo Jonker

Woohoo! I got NTLM to work! What a relief to finally feel “connected” with the rest :)
How I finally managed: I installed NTLM APS version 0.9.9.5, and used the following config values (keeping only the pertinent values, the rest isn’t changed):

[GENERAL]
PARENT_PROXY:

[NTLM_AUTH]
NT_HOSTNAME:
NT_DOMAIN:pwo
USER:hjo
PASSWORD:
LM_PART:1
NT_PART:1
NTLM_FLAGS: 07820000
NTLM_TO_BASIC:0

Let’s see if it still works with debugging turned off…yup! So I’ve updated that in the above description.

I’ve now added a tiny PAC file, proxy-for-local-domain.js:

function FindProxyForURL(url, host) {
        host = host.toLowerCase();
        
        // Route all OU traffic through local NTLM authentication-
        // handling proxy
        if (dnsDomainIs(host, ".ou.nl"))  {
                return "PROXY 127.0.0.1:5865";          // (IP:port)
        }

        // Anything else: just direct
        return "DIRECT";
}

and then configured Firefox to use an automatic proxy configuration url of file://.../proxy-for-local-domain.js. Tested and it works! woohoo!

With some help of the OU IT staff, I got one step closer to two things!

NTLM authentication

This was my goof-up. The cntlm config file was only readable by root. Le doh!
So:

1. install cntlm
2. config /etc/cntlm.conf as:
   

   Username hjo
   Domain www.intranet.ou.nl

   # List of parent proxies to use. More proxies can be defined
   # one per line in format : Proxy 145.20.126.12:8080
   #Proxy 10.0.0.42:8080

   # List addresses you do not want to pass to parent proxies
   # * and ? wildcards can be used
   #
   NoProxy localhost, 127.0.0.*, 10.*, 192.168.*

   # Specify the port cntlm will listen on
   # You can bind cntlm to specific interface by specifying
   # the appropriate IP address also in format :
   # Cntlm listens on 127.0.0.1:3128 by default
   #
   Listen 3128
   Listen 3310

3. run chmod go+r /etc/cntlm.conf
4. Generate the password hashes for authentication: cntlm -H and enter your password. Example:
   

   $ cntlm -H
   Password:
   PassLM FE03A594184396D6552C4BCA4AEBFB11
   PassNT F3496B77FA086840D57D7F868C476AC8
   PassNTLMv2 9AB19C7C88EADFC4DE62B818E2878131 # Only for user ‘hjo’, domain ‘www.intranet.ou.nl’

5. copy the password hash lines to //etc/cntlm.conf below username/domain.

That’s where I’m at now. It still doesn’t work, but we jumped through another hoop! :)

Printing

I followed now the Mac instructions again:

1. Go to the “add printer” dialog
2. Choose LPD printer, add the name.
   Name is something like MFP-XXX-A0YYYY. XXX for my building is HLR – my printer is MFP-HLR-A09550.
3. Download the C360 printer driver (PPD) from the Konica Minolta website (I found multiple options, ended up using the file KOC360UX.ppd)
4. Use this printer driver. Configuration:
   • paper source unit: PC-408
   • Finisher: FS-529
   • Punch Unit: none
   • Saddle kit: none
5. Now you need to set up authentication. I’m not clear on how to do this (doesn’t work yet), but good info seems to be available from:
   • here for printers in the same class (Konica Minolta C220/280/360 share the same printer driver, apparently)
   • here for other printers.
     This explanation includes a link to an explanation on how to send the correct printer commands apparently.

This actually works!

PS: I was running this while using the Java Juniper client, so I was on the VPN.

The OU is using a VPN. You can connect with a Java applet, unfortunately, we’re still running an older version that relies on the 32 bit java version.

Instructions for working around that can be found
here.
Moreover, my home dir is encrypted, which apparently a problem (see comment about encrypted home dirs).
Solution to that one from here:
move the setuid binaries somewhere else and symlink them.
I.e.:

• sudo mv $HOME/.juniper_networks/network_connect/ncsvc /opt/juniper-vpn/ncsvc
• ln -s /opt/juniper-vpn/ncsvc $home/.juniper_networks/network_connect/ncsvc

This gets it working. Funnily enough, I still cannot connect directly to intranet – so what is Juniper now doing for me anyway? :)

Edit
Note that you should *ONLY* link the SUID binary. If you symlink the whole directory, it doesn’t work and Juniper crashes.
(Thanks Juniper, for that fun-filled 45 minutes of hunting the internet on why you crashed!)