View source for Enabling NTLM authentication under RHEL/Apache

== Background<br>  ==

If you need your CGI scripts to know the remote (web client) user who is running IE under Windows, NTLM is a convenient protocol to use.&nbsp; The user will not need to enter his credentials.&nbsp; The CGI script can access the username in the REMOTE_USER environment variable. 

Note that NTLMv1 is vulnerable to cracking.&nbsp; It was replaced with NTLMv2 in the Vista timeframe. 

While there are many apparent alternatives to enable this functionality on RHEL/Apache servers, only one (at the time of this writing) cleanly supports NTLMv2 - a python module called PyAuthenNTLM2. 

== Install  ==

'''Note that this procedure was done on a RHEL6/httpd (apache) box''' 

Become root 

yum install httpd-devel<br>yum install python-devel<br>yum install python-crypto<br>wget http://archive.apache.org/dist/httpd/modpython/mod_python-3.3.1.tgz<br>tar zxf mod_python-3.3.1.tgz <br>cd mod_python-3.3.1<br>vi src/connobject.c <br>&nbsp; change<br>&nbsp;&nbsp;&nbsp;&nbsp; b == APR_BRIGADE_SENTINEL(b)<br>&nbsp; to<br>&nbsp;&nbsp;&nbsp;&nbsp; b == APR_BRIGADE_SENTINEL(bb)<br>./configure --with-apxs=/usr/sbin/apxs <br>make<br>make install<br>

cd ..<br>wget https://github.com/Legrandin/PyAuthenNTLM2/archive/master.zip<br>unzip master<br>cd PyAuthenNTLM2-master<br>python setup.py install<br>

cd /etc/httpd/conf.d/<br>cat &gt;ntlm2.conf<br>&lt;Location /&gt;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; AuthType NTLM<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; AuthName TWTELECOM<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; require valid-user<br><br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; PythonAuthenHandler pyntlm<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; PythonOption Domain TWTELECOM<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; PythonOption PDC srvdendc5<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; PythonOption BDC srvdendc1<br>&lt;/Location&gt;<br>^D 

(The AuthName is whatever you want.&nbsp; The DCs should be near the server) 

<br>cd ../conf<br>vi httpd.conf <br>&nbsp; Change<br>&nbsp;&nbsp;&nbsp;&nbsp; KeepAlive Off<br>&nbsp; To<br>&nbsp;&nbsp;&nbsp;&nbsp; KeepAlive On<br><br>&nbsp; At the end of the LoadModules section insert<br>&nbsp;&nbsp;&nbsp;&nbsp; LoadModule python_module modules/mod_python.so<br>

apachectl configtest

&nbsp; (fix any errors and retry before continuing)<br>

/etc/init.d/httpd restart<br>&nbsp; (apachectl graceful doesn't quite do the job for whatever reason)<br>

== Test  ==

cd /var/www/cgi-bin/<br>cat &gt;whoami.cgi<br>#!/bin/sh<br>printf "Content-type: text/html\n\n$REMOTE_USER\n"<br>^D<br>chmod 755 whoami.cgi

On your Windows PC, using IE, open the url http://yourserver/cgi-bin/whoami.cgi<br>Verify that you windows username is displayed<br>If it isn't, follow the steps in:<br>&nbsp; https://github.com/Legrandin/PyAuthenNTLM2#troubleshooting <br>'''Important: You must completely exit IE and bring it back up with each test'''<br>