Proxy auto-config (PAC) impacts ssh, scp, sftp

Dear all,
I have this problem I am trying to find leads on how to understand and eventually solve it.
I am doing a lot of development under Unix. I'm spending most of my time at work on X11 (XQuartz) logged in on remote Unix servers using all "S" versions of standard protocols.  I'm under Snow Leopard because Lion is no good to my workflow (sorry to say this).
Since my employer has contracted an external company to filter all outgoing HTTPS traffic - and has updated the legacy proxy PAC file accordingly - I encounter huge latency problems with my ssh, scp and sftp traffic with my remote Unix servers : all "S" protocols are routed through the external company HTTPS filter.
I have created one Network Location (network sys prefs) that uses "Automatic Proxy Configuration" to point to the PAC file server (a).
I have create another Network Location that activates a distinct proxy setting for HTTP and the same for HTTPS protocols. I've set up as Web Proxy server the one defined as PROXY  in the PAC file (b).
Using (a) Network preference, all my ssh and scp traffic initiated under X11 is slow as a drag (10kb/s on a 100baseT full duplex to the server in the same building) because it gets piped through the external https traffic filter.
Using (b) Network preference, no problem at all with ssh and scp, and Safari can browse both http and https sites as per company rules.
My question is how can this setting of Network preference - combined with a PAC file - can influence a traffic that is secured through ssl but is not HTTP nor HTTPS ! 
I am looking for some documentation that would help me understand how Proxy auto-config is implemented in the network layer and if there are any recommendations I can do to my network team to fix their PAC file, perhaps, to restrict the proxy configuration to only http and https.
Any lead will help.
Thanks,
Thierry
The PAC file (stripped of restricted info). Note: The remote servers I'm working on are in the 10/24 IP range and a segment of a Class B my company owns.
function FindProxyForURL(url, host)
          var proxy = "PROXY XXX.YYY.ZZZ.1:80; PROXY XXX.YYY.ZZZ.2:80" ;
if (
          shExpMatch(host, "10.*.*.*")  ||
          shExpMatch(host, "192.168.*.*")
          return "DIRECT";
else
          return proxy;

Ooops. Sorry, I meant "10/8", not "10/24" IP range.

Similar Messages

  • Cannot set Proxy Auto Config in iPhone/iPad Configuration Profile

    Hi, All.
    Our enterprise uses internal and external DNS, and we leverage Proxy Auto Config (PAC) files to determine how to resolve hostnames.
    I can create a VPN Configuration Profile with the URL for the PAC file, so that when the VPN is enabled, it will start using the PAC file to resolve.
    However, there is no such option in the WiFi Configuration Profile.
    Any idea if there is a way to automate this, or if Apple intends to include this in a future version of iOS or iPCU?
    Thanks,
    David

    Ooops. Sorry, I meant "10/8", not "10/24" IP range.

  • Proxy auto-configuration (PAC) files

    After some advice on how to create and serve proxy auto-configuration (PAC) files..?
    How to set one up. Syntax, etc.
    Thanks in advance,
    Tim.

    Proxy auto config files are Javascripts that parse the requested URL and return a response to the browser telling it where to go to get the content.
    More info is available in multiple formats

  • Invoke Proxy Auto-Config functions from applet

    hello,
    i heared that we can get proxy information for a URL from Proxy Auto-Config File(.pac), how can we invoke function FindProxyForURL(url, host) in the .pac file, so that i can use the returned proxy details in my java program?
    or, i came to know that package org.mozilla.pluglet.mozilla contains few classes which does the same. from where i can download the package?
    thanks in advance....
    Sojan

    i am also having this problem. i have been searching for atleast two days and have not yet succeded in finding the proxy address. i would be very thankful if someone who has done this before can help.

  • Proxy Auto Config Web Test Plugin - VS 2012

    Hello,
    I am hoping someone can help me with my problem. I've currently created a number of web tests which require a web test plugin in order to run. The issue that I am having is that our company proxy is via Proxy Auto Config file.
    But I cannot find anything about passing this in to the WebProxy object.
    Is there another option for me to pass the config file or url to the file so that my web tests will run correctly?
    Thanks in advance for any help. 

    Hi Pir.Rad,
    This blog introduced how to set  proxy in web test plug-in:
    http://blogs.msdn.com/b/rogeorge/archive/2009/06/23/how-to-authenticate-to-a-proxy-server-within-a-visual-studio-webtest-using-visual-studio-2008-sp1.aspx
    You can reference “So, why do I need to do this in code in a plugin?” section in this blog to write your
    own code.
    Best regards,
    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
    Click
    HERE to participate the survey.

  • Flash plugin use PAC (Proxy Auto Config)?

    Hi,
    I know the flash plugin uses the browser proxy settings.
    But is this still true if the browser is set to use PAC
    (proxy auto congifuration) files to do proxy settings?
    Thanks,
    Felix

    You might check these links out. I am seeing the same issue
    and think the links provide some insight to the problem.
    http://bugs.adobe.com/jira/browse/FP-519
    http://bugs.adobe.com/jira/browse/FP-673

  • A lan address for proxy auto config in mozilla firefox!

    i must type a lan or pac file address in network auto config proxy addres line.

    It is not possible to enter internet information in the Advanced > Network > How Firefox connects to the internet> Settings... When you click on "Auto-detect proxy settings for this network" that option is greyed out. Auto detect detects the system configuration. Please make sure that the system proxy configuration is set up correctly.
    If you have any other questions, please do not hesitate to ask.

  • Access proxy from terminal using proxy auto-config

    I know about using ntlmaps to wrapper my proxy configurations e get access from Terminal, iTerm2, &c exporting http_proxy variable and others. But I don't want go on using this approach because it simply ***** (forgive me for this word...) for a lot of issues.
    I would like simply setup my proxy environment on Network Preferences/Advanced/Automatic Proxy Configuration: (host: http://myproxy/proxy.pac) and using this setup for a whole system, including my terminals. Therefore, are there any way to reach it?
    Another details, my proxy is authenticated and uses ntlm type and in browser I use internet without problems.
    Thanks a lot for any help!
    -Leo

    I am not quite sure what you are looking for. Mac OS X has supported auto proxy configuration since 10.6 Snow Leopard was introduced (acutally in response to a request I made ). If you open System Preferences, click on Network, then go to the Advanced settings for your network interface, in the Proxies tab there is an option called Auto Proxy Discovery. This is different to Automatic Proxy Configuration which was also available in previous versions of OS X. Automatic Proxy Configuration uses a selected PAC file (Proxy Auto Configuration file) but Auto Proxy Discovery uses the WPAD method of finding your proxy server.
    See this article for information about WPAD (Web Proxy Automatic Detection).
    http://en.wikipedia.org/wiki/Web_Proxy_Autodiscovery_Protocol
    WPAD uses either an option advertised from your DHCP server giving the address of your proxy server, or WPAD can use a standard URL based on your domain name to download a dat file containing your proxy server details.
    I have seen reports saying the the DNS method is problematic with Mac OS X but also seen reports that the DHCP method does work with this option successfully. So my suggestion is to define the DHCP option code 252 to advertise your proxy server.
    Note: Thanks to yet another request I made in the past the Mac OS X DHCP Server can be manually configured to define additional DHCP option codes including option 252. The ability to define DHCP option codes was added in Mac OS X 10.5 Server (Leopard).

  • Is Proxy Auto-config functional?

    I find that when using a PAC file to configure browsers on Tiger, it just does not work. Manual proxy settings work as expected; and the PAC file method works on other platforms - but not the Mac. Is this a known issue?

    Hi Chavez, are you using these steps...
    http://www.its.unimelb.edu.au/support/networks/proxy/macosxtiger
    One problem/fix...
    http://www.joesapt.net/2005/12/29/14.44.11/

  • HTTP Proxy / Auto config script on Wifi

    I am currently running a Curve 9220. I am in an area where the WiFi network requires an http proxy and port to be inputted along with authentication or the automatic configuration script can also be entered along with pop-up window for authentication. How can i enter these settings into my BB to make my wifi work?

    Hey daraius1995,
    Welcome to the BlackBerry® Support Community Forums.
    The BlackBerry smartphone does not have an option to configure HTTP Proxy for Wi-Fi, this is by design. For more information please see the following article:
    No option to configure HTTP Proxy for Wi-Fi on the BlackBerry smartphone
    http://btsc.webapps.blackberry.com/btsc/KB32112
    Thanks.
    -HB
    Come follow your BlackBerry Technical Team on twitter! @BlackBerryHelp
    Be sure to click Kudos! for those who have helped you.Click Solution? for posts that have solved your issue(s)!

  • Java proxy auto-configuration and Microsoft PAC script extensions

    Hi,
    Within our proxy auto-configuration PAC script, we have to use the Microsoft IPv6 PAC script extensions such as myIPAddressEx rather than the old myIPAddress. This is required in order to get the PC's internal 10.0.0.0/8 IPv4 address rather than the IPv6 or wi-fi card addresses that are often returned when using myIPAddress.
    However, as soon as we change from myIPAddress to myIPAddressEx, Java seems to be unable to process the PAC script.
    Here are the extensions (introduced many years ago:
    IPv6-Aware Proxy Helper API Definitions (Windows)
    Question - does Java support these extensions or have plans to?
    Thanks,
    Kev.

    Proxy auto config files are Javascripts that parse the requested URL and return a response to the browser telling it where to go to get the content.
    More info is available in multiple formats

  • Proxy Auto-Discovery

    I am in need of having student laptops over the wireless automatically pointed towards a proxy. One option I know is a transparent proxy, but we'd like to be able to let certain users opt out by changing the settings if possible. I found this option in the bootpd manual page:
    dhcpproxy_auto_discoveryurl
    I added it to my bootpd server by using NetInfo Manager:
    dhcpproxy_auto_discoveryurl -> http://192.168.1.99/test.pac
    At first I didn't think it was working, but I booted my MacBook Pro into my windows partition and sure enough it all seemed to work. Both IE and Firefox auto-detected the .pac file and started directing their traffic there. I boot into Mac OS X again and it's still not working.
    Has anyone had any success with this option to deploy proxy settings? Is there an easier way that doesn't require me manually pointing 200 workstations to a .pac file on the internet? Is this simply a feature that doesn't work in Mac OS X 10.4?
    Shane

    You may need to configure the clients to use an auto-discovered PAC file.
    If you look in System Preferences -> Network -> (interface) -> Proxies you can tell the OS to either use a PAC or use manual settings. It's likely that if you're set to Manual (the default) it ignores the DHCP PAC setting (although that's only a theory).
    You may be able to automate this using networksetup, if it's installed on your systems (part of ARD). If it is you can:
    <pre class=command>sudo networksetup -setautoproxystate "Built-in Ethernet" on</pre>

  • Web Proxy Auto Discovery (WPAD) fails in Creative Cloud

    The Creative Cloud desktop application has a problem with WPAD automatic proxy detection.  When the computer is configured to "automatically detect settings", the Creative Cloud application will not load the Apps list, giving the error "Download Error.  Unable to reach Adobe servers.  Please check your internet  connectivity, firewall settings, and then try again."  All other elements of the Creative Cloud application (logging in, accepting terms of use, the "Home", "Files", "Fonts" and "Behance" tabs have no issues using the automatically detected settings).  I can refresh a netstat on the command line and see that the Creative Cloud application tries to make direct calls to the EC2 servers when attempting to connect to the "Apps" list instead of using the proxy.
    If I manually configure a PAC file or manually configure the proxy on the computer, the Creative Cloud can connect successfully.  The failure only occurs with "automatic detect settings".  I have tested different WPAD server configurations, to include Apache on Unix, IIS7 on Windows, text/plain and application/x-ns-proxy-autoconfig MIME types, and CNAME vs A record for 'wpad'.  Creative Cloud continues to fail to operate correctly.
    The old version of Adobe Application Manager can successfully connect and download updates using "automatic detect settings".  It will update itself (and installed apps) successfully.  After it updates itself, it will connect and update itself a second time, this time replacing itself with the Creative Cloud application, which fails to connect.  This behaviour is new to the Adobe Application Manager once it becomes the Creative Cloud application.
    It seems from what "official" documentation I can find that this is currently "broken as designed" (see Adobe references at bottom of post).  Connecting directly from a client to the internet without a proxy is prohibited by our information security policy (the chat support agent tried to tell me 3 times that the "solution" was to disable the proxy and open ports 80 and 443 to the internet).  Manually configuring the proxy through a PAC file or manually setting proxy information causes other issues and performance problems (I strongly disagree with Adobe staff member Jeff Wright's assertion that automatically detecting the settings is "a common issue with most applications"--see reference at bottom of post).
    While I could technically open the firewall or manually configure the proxy to make the Creative Cloud function properly, these are unacceptable workarounds as already stated.  Considering that the previous iteration (Adobe Application Manager) functioned just fine with automatically detected settings, and that the rest of the Creative Cloud application functions properly with automatically detected settings, it seems that this should be a minor issue to correct with the application, to ensure that the application cataloging and downloading respects the same configuration as the rest of the client.  What is the official Adobe position on the current broken functionality of the Creative Cloud application, and what is the timeline in implementing a fix?
    Pertinent Adobe articles:
    Creative Cloud Help / Troubleshoot download and install issues (http://helpx.adobe.com/creative-cloud/kb/troubleshoot-cc-installation-download.html):
    Corporate environments: Configure Hardware firewalls or proxies
    Many organizations use a hardware firewall and proxy server that can prevent software from accessing an FTP server. A hardware solution applies to all computers within the corporate network. Most home networks do not use hardware firewall or proxy technology. 
    1. Contact your company's IT department to obtain firewall or proxy information.
    2. Configure your browser with proxy or firewall information.
    3. Configure your corporate firewall to by-pass the servers. The following servers are accessed:
                 ccmdl.adobe.com:80
                 swupmf.adobe.com:80
                 swupdl.adobe.com:80
    Post from Adobe staff member Jeff A Wright (Reply 14: http://forums.adobe.com/message/5620841):
    Quote: "The automatic detection of settings or the automatic configuration script is not currently supported.  Although to be honest when I worked regular in an environment, which utilized a proxy server, this seemed to be a common issue with most applications.  The manual configuration was the most reliable method of utilizing a proxy server and allowing the applications to access the Internet."

    Thx! that worked! now I can download Apps.
    (using squid proxy)
    Thx a lot

  • Outlook 2010 Auto Config doesnt tick the "use outgoing mail server auth" settings

    Hi Guys
    I've got a domain here and an auto-config setup for Outlook whereby it goes to a website on the domain controller and downloads an xml looking like this:
    <?xml version='1.0' encoding='utf-8' ?>
    <Autodiscover xmlns='http://schemas.microsoft.com/exchange/autodiscover/responseschema/2006'>
    <Response xmlns='http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a'>
    <User>
    <DisplayName>User Name</DisplayName>
    </User>
    <Account>
    <AccountType>email</AccountType>
    <Action>settings</Action>
    <Protocol>
    <Type>IMAP</Type>
    <Server>mail.host.com</Server>
    <Port>143</Port>
    <LoginName>[email protected]</LoginName>
    <DomainRequired>off</DomainRequired>
    <SPA>off</SPA>
    <SSL>off</SSL>
    <AuthRequired>on</AuthRequired>
    </Protocol>
    <Protocol>
    <Type>SMTP</Type>
    <Server>mail.host.com</Server>
    <Port>25</Port>
    <LoginName>[email protected]</LoginName>
    <DomainRequired>off</DomainRequired>
    <SPA>off</SPA>
    <SSL>off</SSL>
    <AuthRequired>on</AuthRequired>
    <UsePOPAuth>on</UsePOPAuth>
    <SMTPLast>on</SMTPLast>
    </Protocol>
    </Account>
    </Response>
    </Autodiscover>
    As can be seen, we use IMAP here rather than exchange
    Now, when I go to set up an account, outlook DOES configure most things presented in this XML, but there seems to be a bug in that while it knows and enables "My outgoing server(SMTP) requires authentication" checkbox, it DOESN'T then enable the relevant
    radio button that one would assume <UsePOPAuth> (== use the same settings as my incoming server) intends.. No radio button is checked, which means that mails do NOT send :/
    Here's a pic:
    So, alas, my auto-setup still requires the depeest level of manual interaction to set it up.. i.e. it's fairly useless. I'd say for sure this is a bug in outlook's auto config, but how to report it to microsoft?

    Hello,
    Thank you for your report. I am trying to involve someone familiar with this topic to further look at this issue.
    Tony Chen
    TechNet Community Support
    A new Office has arrived, try it now.
    A beautiful Start. It begins here. Windows 8 and Windows RT.
    Please remember to mark the replies as answers if they help and unmark them if they provide no help.

  • Sending order data to an external system using scp sftp (osm 631.221)

    Hello There,
    I need to come up with a means of sending some order data to an external system via SCP or SFTP.
    I was looking at an automated task that would fire off some Java to package the data, create the file and send it.
    I then have to write another automated task that will block the order and check the file system for a return file and then update the order with the data from the file.
    Does any one have ideas on the best / recommended approach to achieve this ?
    I am obliged :-( to send and receive the file via SCP/SFTP.
    any help would be appreciated.
    Jim

    Hi Jim;
    Using a custom Java automation plugin is the right place to start to tackle the problem. There are several Java libraries that you could consider. Apache Commons VFS (http://commons.apache.org/vfs/index.html) supports both SCP and SFTP and insulates you from having to deal with the specifics of either so you may want to start there.
    As for the problem of getting a response, given that there is no notification type capability with those type of file systems, you will have no choice but to poll to check if the file exists. Not pretty, but so long as you are not dealing with very high volumes it should work ok. You can model the polling as a subprocess consisting of two tasks. Task A is implemented by a custom automation plugin using VFS or similar to go and check if the file exists, and if it does download it. If the file exists and is downloaded successfully then the task completes with a success status. If the file does not exist then it completes with a retry status. The retry status is mapped to a delay rule task - and the delay rule task simply waits for some interval (e.g. 1 minute) after which it completes and loops back to Task A.
    Hope this helps,
    Brian.

Maybe you are looking for

  • How can I do a factory recovery on my PC?

    Hello there, My name is Kyle and I own a Lenovo K430-31092JU desktop PC.  I want to completely swipe my computer and start fresh at factory settings. I don't have a recovery disc (or partition drive), so I'm wondering how I can do this. Is this somet

  • Bitt locker loss a recovery Key

    my respected sir                        i am using window 7 ultimate on my computer i lost my recovery key of Bit locker when i use the password to unlock my driver Show this massage (bit lockernot Response) how i can unlock my Drive. In my drive my

  • No sound in Timeline (only)

    I just got a new copy of FCP X from the Apple Store. My clips sound good in the event library but not when transferred to the Timeline, eventhough I see the sound track, which is strange.

  • DTP Short dump issue

    Hi Expert, I face a DTP shortdump issue on loading data from PSA to DSO The DSO is write optimize. DTP is using symantic loading and support 3 processor, pack size is default Situation is as below: 1. This issue occurs every two days. In some situati

  • Weblogic Server 10.0 automatic undeployment

    How can I perform common development cycle: code update - save - deploy - preview in Workshop? I'm running WLS under Workshop and when I start my Dynamic Web Project and then try to Publish changes I'm getting the exception that application is alread