GitHub Windows client behind proxy

Question

I'm trying to get the GitHub client for Windows working. I am on a corporate Windows 7 x64 computer behind a corporate proxy and firewall.

Following various other posts and experimenting with multiple combinations of environment variables and configuration variables, I have found the only way to get cloning and push updates to work is by using the HTTPS_PROXY environment variable, including my full corporate domain user ID and password.

This is unacceptable from a security standpoint. Is there another way to get this to work?

Additional notes:

The following worked:

• Add an environment variable called HTTPS_PROXY with the value http://[domain]\[userid]:[password]@someproxy.mycorp.com:8080

The following did not work:

• Omitting user id and password from HTTPS_PROXY variable
• Using an environment variable called HTTP_PROXY (no S)
• Adding the http.proxy variable to the global configuration file (.gitconfig)
• Adding the https.proxy variable to the global configuration file

In all cases, the GitHub client still does not recognize the proxy: The content of the file TheLog.txt always shows the following on startup:

[time]|INFO|thread:4|GitHub.Helpers.StartupLogger|Proxy information: (None)
[time]|INFO|thread:4|GitHub.Helpers.StartupLogger|Couldn't fetch creds for proxy

And it is followed by the output of several failed proxy authentication attempts, all of which indicate "Credentials are missing."

Uncivilized

Adding the environment variable did the trick for me, but it is an unacceptable solution, as it exposes my domain/password to any application with access to the environment variables. – Encrata

jacobbenson.com/?p=302#sthash.DzPYdGUU.dpbs explains that this is caused by the gui (which correctly uses the windows set proxy) calls msysgit behind the scenes for the git commands. msysgit uses libcurl for http requests, which doesn't use the windows proxy settings. There is work ongoing to fix this in several areas including with libgit2sharp at github.com/libgit2/libgit2sharp. – Karrykarst

Answer 1

Add these entries to your '.gitconfig' file in your user directory (go to %USERPROFILE%):

[http]
    proxy = http://<proxy address>:<proxy port>

[https]
    proxy = https://<proxy address>:<proxy port>

And if you don't want to store your password in plaintext, I would use a local proxy forwarder like CNTLM which allows you to direct all traffic through it and can store the passwords hashed.

---

Unlike the original question, if you don't care if your password is in plain text add these:

[http]
    proxy = http://<username>:<password>@<proxy address>:<proxy port>

[https]
    proxy = https://<username>:<password>@<proxy address>:<proxy port>

Karalynn

see edufinn answer if you need authorization against the proxy: proxy=http://<username>:<password>@<corporate proxy>:<port> – Vile

@JanHommes The original question was specifically asking about how to do it without storing the password in plaintext – Karalynn

@Karalynn If my password include "@" character, how should i configure the password, thanks for your help. – Venture

@Venture stackoverflow.com/questions/6172719/… – Karalynn

CNTLM was a fantastic suggestion. +1 – Sayyid

@Karalynn For me this didn't help. I need to write my System username and password in there, right? – Grammatical

@AndroidNFC You need to use your proxy credentials, whatever those are for you – Karalynn

If you are using CNTLM, make sure you point the proxy to 127.0.0.1 instead of localhost, as suggested. In Windows, it appears that localhost points first to the IPv6 address, which CNTLM doesn't listen to. As such, git will wait until the timeout (several minutes) before switching to the IPv4 address. – Moniz

I just added another answer which expands on this to show how it can be done without CNTLM or storing the credentials. (As long as your proxy server supports turning off the AUTH requirement for *.github.com) – Crider

It worked well for me. I made it permanent for my local repo settings since I always access this repo behind the proxy. I made git config http.proxy http://<url>:port and git config https.proxy http://<url>:port. – Orate

I'm on a corporate Windows 10 (1803) network, and passwords in plain text is not acceptable. I added my username and password for our proxy-servers to Control Panel > User Accounts > Credential Manager > Windows Credentials as Windows Credentials (instead of using CNTLM). Together with the above solution for .gitconfig it works for me. – Faroff

Answer 2

I tried everything in the previous answers, but I didn't succeed. The only thing that helped me was CNTLM.

Install it and run cntlm -H, then authenticate to the corporate proxy, edit the cntlm.ini file with the output of cntlm, and restart the windows service. Update file .gitconfig with:

[https] proxy = localhost:3128
[http] proxy = localhost:3128

Now cntlm will do all the authentication, and you'll be able to use GitHub (and Dropbox, btw) behind the corporate proxy. At least until the next password change :) (then do the cntlm -H stuff again)

Wisp

If remote actions like git clone, fetch or pull take a very long time to complete, try switching the .gitconfig to: [https] proxy = 127.0.0.1:3128 [http] proxy = 127.0.0.1:3128 – Equally

restart what windows service? – Neurologist

@Neurologist cntlm - it runs in service mode after installation, if I remember correctly. – Wisp

I made the change, restarted it and it still does not work. – Neurologist

Answer 3

I was able to make GitHub Shell work with our corporate proxy. I'm starting GitHub Shell and execute following command:

export http_proxy=http://<username>:<password>@<corporate proxy>:3128

I would really like to make GUI to work too. But I don't want to set the Windows global environment variable which contains my corporate credential information.

Strangely, GitHub GUI Client is able to connect to GitHub for user authentication, but the only problem is with cloning, pulling and pushing projects from and into GitHub. It seems like the problem is with the Git implementation. I was able to configure Git to run through our proxy without putting my credentials in the Git global settings and it was asking for my credentials while performing pull or push requests. But that was working only in Git Shell.

Dialogue

That's because probably GitHub authenticates internally with some component that pulls proxy info from the OS, possibly some SingleSignOn solution, while git itself does not. I have the same problem with SourceTree. I also found that when git works, it takes an impossibly long time to work, making SourceTree usage impossible. – Moniz

This is likely because Github is trying to use the git port which is typically filtered as its not a common one for IT folks to see. See my answer for an alternative. – Demagogic

Answer 4

If you’re using GitHub for Windows in a corporate place, chances are high that you’re behind a big bad corporate firewall or proxy. GitHub for Windows doesn’t yet have the proxy parameters in its GUI for setting options.

To configure GitHub for Windows to use your corporate proxy, edit the .gitconfig file typically found at C:\Users<yourusername>.gitconfig or C:\Documents & Settings<yourusername>.gitconfig

Close GitHub for Windows; in file .gitconfig, just add:

[https]
proxy = proxy.yourcompany.com:port

Hobbie

Answer 5

I've also run into this issue, and tried to dig into it a bit as well (disassembled the client).

The piece of code that generates the log messages we're seeing is as follows:

private static void LogProxyServerConfiguration()
{
    WebProxy defaultProxy = WebProxy.GetDefaultProxy();
    string str = defaultProxy.Address != (Uri)null ? defaultProxy.Address.ToString() : "(None)";
    StartupLogger.log.Info((IFormatProvider)CultureInfo.InvariantCulture, "Proxy information: {0}", str);
    try
    {
        if (defaultProxy.Credentials == null)
        {
            StartupLogger.log.Info((IFormatProvider)CultureInfo.InvariantCulture, "Couldn't fetch creds for proxy", new object[0]);
        }
        else
        {
            NetworkCredential credential = defaultProxy.Credentials.GetCredential(GitHubClient.GitHubDotComUri, "Basic");
            StartupLogger.log.Info((IFormatProvider)CultureInfo.InvariantCulture, "Proxy is authenticated: {0}", credential != null && !string.IsNullOrWhiteSpace(credential.UserName));
        }
    }
    catch (Exception ex)
    {
        StartupLogger.log.InfoException("Couldn't fetch creds for proxy", ex);
    }
}

So this block only logs the proxy information that's setup in IE. The log message appears to have no bearing on what we have setup in the config files or environmental variables.

Beuthen

Answer 6

I don’t know about your firewall, but my campus uses a proxy.

Do you use any Git GUI? I just noticed that you're using the GitHub client for Windows.

I am using TortoiseGit and its very easy to set the proxy. Just right click anywhere, TortoiseGit → Network, enable the proxy server and set the server address, username, and password. Done.

As far as I remember, TortoiseGit will also works out-of-the-box with GitHub.

Sirrah

Answer 7

Here is the way to set the proxy in GitHub:

git config --global http.proxy http://<username>:<pass>@<ip>:<port>
git config --global https.proxy http://<username>:<pass>@<ip>:<port>

Here in my college we don't have usernames and passwords, so if our college IP address is 172.16.10.10 and the port is 8080:

git config --global http.proxy http://172.16.10.10:8080
git config --global https.proxy http://172.16.10.10:8080

P.S.: I would recommend using this method to set proxy as things will fall into place as you will learn further. Source

Heck

Answer 8

I found this blog to be useful. It describes ntlmaps proxy. It's probably less secure, but worked smoothly. I couldn't get cntlm working.

Emrich

That isn't sufficient. Can you summarise here? – Wehner

The link is (effectively) broken. The entire hwiechers.blogspot.com blog was removed. – Wehner

Answer 9

For us, the solution involved two different things. First, as described in Sogger's answer, you need to add the entries to your .gitconfig file, located in %USERPROFILE%.

[http]
    proxy = http://<proxy address>:<proxy port>

[https]
    proxy = https://<proxy address>:<proxy port>

Second, (and this was the missing piece for us,) you need to configure an exception on the proxy server to allow non-authenticated proxy traffic to *.github.com

In iPrism, it looks like this:

The problem is not so much the proxy, but the authentication. Bypassing the authentication requirement allows the needed communication to clone and work with projects using the GitHub desktop client.

Also note that this approach did not require storing proxy credentials in the .gitconfig file.

Crider

Answer 10

In case you need to force Git or GitHub client to bypass the proxy (use the direct connection), just set the proxy URI in the .gitconfig to an empty string. You'll probably have to edit the file manually, but I didn't manage to persuade the git config command to set the value of a configuration directive to an empty string (tried git config --global http.proxy "").

So just add the following lines to the ~/.gitconfig:

[http]
    proxy = ""
[https]
    proxy = ""

Nadiya

This will not work if you are in a corporate environment and there is no way to bypass the proxy. – Rawden

@SteveScott Sure, but for me, it was the only way to get through/around the corporate proxy (as we didn't have proxy authentication credentials). It's probably a network misconfiguration, because it doesn't make a sense to enforce a proxy that you can bypass, but for me, it was important that I can configure my tools so they're able to connect to the internet in such environment. – Colis