Apt proxy settings are not transmitting username/password

Question

On a 12.04 server machine, I've got Apt configured to use a proxy to grab its packages. To wit, in /etc/apt.conf.d/80proxy, I have the two following lines:

Acquire::http::Proxy "http://user:password@proxybox:8443/";
Acquire::https::Proxy "http://user:password@proxybox:8443/";

However, when trying to do an apt-get update, I receive an HTTP 407 (Proxy authentication required).

Further examination of the log on the proxy machine, and a TCP dump, indicates that the username and password configured in the URL are not being transmitted. The username and password never reach the proxy machine.

Troubleshooting:

• I've verified that this machine can access the proxy by doing a curl:

  http_proxy='http://user:password@proxybox:8443/' curl google.com

• I've verified that my password does not contain any special characters.

• I've verified that there are no other proxy settings on the machine.

  • grep -ri proxy /etc/profile* returns nothing
  • grep -ri proxy /etc/apt/* returns nothing but the file above
  • env | grep -i proxy returns nothing

Here's what the tcpdump from an attempt with curl looks like:

CONNECT apt.dockerproject.org:443 HTTP/1.1
Host: apt.dockerproject.org:443
Proxy-Authorization: Basic (redacted)
User-Agent: curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3
Proxy-Connection: Keep-Alive

And an attempt with apt-get:

CONNECT apt.dockerproject.org:443 HTTP/1.1
Host: apt.dockerproject.org:443
User-Agent: Debian APT-CURL/1.0 (0.8.16~exp12ubuntu10.24)
Proxy-Connection: Keep-Alive
Cache-Control: max-age=0

Note the lack of the Proxy-Authorization header.

How do I get apt to respect the user/password settings I've defined in the configuration file?

Answer 1

From what I picked up this is an issue with the specific version of apt. I found this bug report https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1087512. The original author mentions

The problem is that the https transport mangles the proxy string before passing it to curl and strips the proxy credentials.

I'm not sure if you can upgrade apt to the fixed version in that report (I can't tell if it was backported to 12.04 and earlier), but if not there is a work around you can use in the last comment from rvolgers which is:

By the way there was a workaround that allowed proxy authentication to work with https in the old version, but unfortunately this will break once the fix ships (not surprising, since it shamelessly abuses the overly permissive URI parser in apt):

Acquire::http::proxy "http://username:password@hostname:port";

Acquire::https::proxy "http://username:password@username:password@hostname:port";

(In other words, duplicating the username:password@ part for the https proxy only.)

Again, I recommend against using this, since your apt config will stop working once this fix is backported.

I hope the work around will work for you (I am unable to test myself), and if so, remember to undo this on your next upgrade.