Thought I’d start using Git from my workplace too. Why not! Little did I realize it would take away a lot of my time today & yesterday …<\/p>\n
For starters we have a proxy at work. Git can work with proxies, including those that require authentication<\/a>. Issue the following command:<\/p>\n Or add the following to your global config file:<\/p>\n Apparently this only works with Basic authentication but since version 1.7.10 it works with NTLM authentication too<\/a> (I didn’t test this). That’s no dice for me though as there’s no way I am going to put my password in plain text anywhere! So I need a way around that.<\/p>\n Enter Cntlm<\/a>. Cntlm sits between the proxy and your software. Its runs on your machine and authenticates with the proxy\/ proxies you specify. (The config file takes password hashes instead of the plain text password). Your programs talk to Cntlm without any authentication; Cntlm then talks to your proxy after proper authentication etc. Cntlm is quite portable. When installing it creates a service and all, but you can run it by launching the This way I can pull repositories over https. When I tried pushing though, I was stuck. I am asked for a username\/ password and while I am entering the correct details it keeps rejecting me:<\/p>\n Turns out that’s because I use 2 factor authentication so I must create an access token<\/a>. Did that and now I can push!<\/p>\n But that’s not very ideal as I don’t like storing the access token someplace. It’s a long piece of text and I’ll have to paste it in Notepad and copy paste into the command prompt each time I push.<\/p>\n Notice above that I am using HTTPS instead of SSH as is the norm. That’s because SSH won’t work through the proxy. If SSH works I could have used keys as usual. The good thing about keys is that I can passphrase protect it so there’s something known only to me that I can type each time. And if I ever need to revoke access to my office machine I only need revoke that key from GitHub.<\/p>\n SSH can’t be tunnelled through the HTTP proxy. Well not directly at least, through there is But before that I want to see what I can do to ease access tokens an HTTPS access.<\/p>\n Turns out Git has ways<\/a> to ease entering passwords or access tokens. Starting with version 1.7.9<\/a> it has the concept of credential helpers which can feed Git with your credentials. You can tell Git to use one of these credential helpers – maybe the GNOME Keyring – and Git will get your credentials from there. Older version of can use a Git 1.8.1 and above has in-built support<\/a> for Windows (via the So it is not too much of a hassle using Git with HTTPS via an proxy like Cntlm and using the in-built credential helper to store your credentials in the Windows Credential Store. And if you ever want to revoke access (and are using two-factor authentication) you can simply revoke the access token. Neat!<\/p>\n Back to SSH. Here’s<\/a> the Wiki page for The Wiki page suggests a way to test SSH through The syntax is straight-forward. I launch From the output I see it fails. Bummer! My work proxy is blocking traffic to port 22. Not surprising.<\/p>\n Thankfully GitHub allows traffic over port 443<\/a> (the HTTPS port). Must use hostname ssh.github.com though instead of github.com. Let’s test that:<\/p>\n Superb! It works.<\/p>\n Now all I need to do is open\/ create All this does is that it tells SSH to launch Simple! Once I do these I can start pushing & pull Git over SSH too. Not bad eh.<\/p>\n While writing this post I discovered that Thought I’d start using Git from my workplace too. Why not! Little did I realize it would take away a lot of my time today & yesterday … For starters we have a proxy at work. Git can work with proxies, including those that require authentication. Issue the following command: git config –global http.proxy http:\/\/mydomain\\\\myusername:mypassword@myproxyserver:8080 … Continue reading Notes on using Git from behind a firewall, tunneling SSH through a proxy, Git credential helpers, and so on …<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[102,85],"tags":[103,396,377],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/2355"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=2355"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/2355\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=2355"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=2355"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=2355"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}git config --global http.proxy http:\/\/mydomain\\\\myusername:mypassword@myproxyserver:8080<\/pre>\n
[http]\r\n proxy = http:\/\/mydomain\\\\myusername:mypassword@myproxyserver:8080<\/pre>\n
exe<\/code> file and pointing it to the config file. Very convenient. I quickly created a shortcut with this and pinned to my taskbar so I can launch Cntlm whenever required (and it stays in the foreground, so closing the window will close Cntlm).<\/p>\nUsername for 'https:\/\/github.com': xxxx\r\nPassword for 'https:\/\/xxxx@github.com':\r\nremote: Invalid username or password.\r\nfatal: Authentication failed for 'https:\/\/github.com\/rakheshster\/BatchFiles.git\/'<\/pre>\n
connect.c<\/code><\/a> which is an SSH over HTTP proxy. Luckily it has Windows binaries<\/a> too so we can try that.<\/p>\n.netrc<\/code> file and you can do the same with Windows version of Git too<\/a>. You can also cache the password in memory for a specified period of time via the cache<\/code> credential helper<\/a>.<\/p>\nwincred<\/code> helper). Prior versions can be setup with a similar helper downloaded from here<\/a>. Both helpers store your credentials in the Windows Credential Store<\/a>.<\/p>\nconnect.c<\/code>, the SSH over HTTP proxy I mentioned above.<\/p>\nconnect.c<\/code>. But first, here’s what the SSH link for one of my repositories look like:
git@github.com:rakheshster\/BatchFiles<\/code>. The hostname is github.com<\/code>, the username is git<\/code>, and the path I am trying to access is rakheshter\/BatchFile<\/code> (i.e. username\\repository<\/code>). Let’s see if I can connect to that via connect.c<\/code>:<\/p>\nC:\\>connect.exe -H 127.0.0.1:53128 -d github.com 22\r\nDEBUG: making direct addr list from network adapter address:\r\nDEBUG: adding direct addr entry: 192.168.50.0\/255.255.255.0\r\nDEBUG: adding direct addr entry: 127.0.0.0\/255.0.0.0\r\nDEBUG: 2 direct address entries.\r\nDEBUG: relay_method = HTTP (3)\r\nDEBUG: relay_host=127.0.0.1\r\nDEBUG: relay_port=53128\r\nDEBUG: relay_user=rakhesh\r\nDEBUG: local_type=stdio\r\nDEBUG: dest_host=github.com\r\nDEBUG: dest_port=22\r\nDEBUG: checking github.com is for direct?\r\nDEBUG: github.com is for not direct.\r\nDEBUG: connecting to 127.0.0.1:53128\r\nDEBUG: begin_http_relay()\r\nDEBUG: >>> \"CONNECT github.com:22 HTTP\/1.0\\r\\n\"\r\nDEBUG: >>> \"\\r\\n\"\r\nDEBUG: <<< \"HTTP\/1.1 403 Forbidden\\r\\n\"\r\nDEBUG: http proxy is not allowed.\r\nFATAL: failed to begin relaying via HTTP.<\/pre>\n
connect.c<\/code>, telling it to use the proxy at 127.0.0.1:53128 (where Cntlm is listening) and ask it to connect to github.com on port 22 (the SSH port). The -d<\/code> switch tells connect.c<\/code> to emit debugging info.<\/p>\nC:\\>connect.exe -H 127.0.0.1:53128 -d ssh.github.com 443\r\nDEBUG: making direct addr list from network adapter address:\r\nDEBUG: adding direct addr entry: 192.168.50.0\/255.255.255.0\r\nDEBUG: adding direct addr entry: 127.0.0.0\/255.0.0.0\r\nDEBUG: 2 direct address entries.\r\nDEBUG: relay_method = HTTP (3)\r\nDEBUG: relay_host=127.0.0.1\r\nDEBUG: relay_port=53128\r\nDEBUG: relay_user=rakhesh\r\nDEBUG: local_type=stdio\r\nDEBUG: dest_host=ssh.github.com\r\nDEBUG: dest_port=443\r\nDEBUG: checking ssh.github.com is for direct?\r\nDEBUG: ssh.github.com is for not direct.\r\nDEBUG: connecting to 127.0.0.1:53128\r\nDEBUG: begin_http_relay()\r\nDEBUG: >>> \"CONNECT ssh.github.com:443 HTTP\/1.0\\r\\n\"\r\nDEBUG: >>> \"\\r\\n\"\r\nDEBUG: <<< \"HTTP\/1.1 200 Connection established\\r\\n\"\r\nDEBUG: connected, start user session.\r\nDEBUG: <<< \"Connection: close\\r\\n\"\r\nDEBUG: <<< \"\\r\\n\"\r\nDEBUG: connected\r\nDEBUG: start relaying.<\/pre>\n
%HOMEDRIVE%\\.ssh\\config<\/code> and add the following lines:<\/p>\nHost *\r\n ProxyCommand \"C:\\path\\to\\connect\\connect.exe\" -H 127.0.0.1:53128 %h %p \r\n\r\n# force github.com:22 to go to ssh.github.com:443 as only HTTPS port is allowed by my proxy\r\nHost github.com\r\n Hostname ssh.github.com\r\n Port 443 <\/pre>\n
connect.c<\/code> to pass SSH connections through my proxy. Further, for any connections to github.com (on port 22), connect to ssh.github.com on port 443 instead.<\/p>\nconnect.c<\/code> is already a part of the Windows version of Git, so there’s no need to download it separately. Super!<\/p>\n","protected":false},"excerpt":{"rendered":"