代理阻塞 apt-get，允许 wget/curl

Question

我在通过我的公司代理服务器时遇到问题。我设置了一个例外来允许我的 IP 地址通过，但无法开始apt-get工作。

wget 可以毫无问题地访问 Ubuntu 存储库。

root@server:/tmp# http_proxy=http://<PROXY>:8080 wget http://us.archive.ubuntu.com/ubuntu/dists/precise-backports/multiverse/binary-i386/Packages.bz2
--2014-01-24 09:17:38--  http://us.archive.ubuntu.com/ubuntu/dists/precise-backports/multiverse/binary-i386/Packages.bz2
Resolving <PROXY> (<PROXY>)... x.x.x.25, x.x.x.24
Connecting to <PROXY> (<PROXY>)|x.x.x.25|:8080... connected.
Proxy request sent, awaiting response... 200 OK
Length: 5178 (5.1K) [application/x-bzip2]
Saving to: `Packages.bz2'

100%[========================================>] 5,178       --.-K/s   in 0.001s

2014-01-24 09:17:38 (7.78 MB/s) - `Packages.bz2' saved [5178/5178]

root@server:/tmp# ll -h
total 16K
drwxrwxrwt  2 root root 4.0K Jan 24 09:17 ./
drwxr-xr-x 23 root root 4.0K Jan 16 14:14 ../
-rw-r--r--  1 root root 5.1K Jan 24 09:05 Packages.bz2
root@server:/tmp#

我设置了我的 apt-conf.d 代理配置。

root@server:/tmp# cat /etc/apt/apt.conf.d/30proxy
Acquire::http::proxy "http://<PROXY>:8080";
Acquire::ftp::proxy "ftp://<PROXY>:8080";
Acquire::https::proxy "https://<PROXY>:8080";
root@server:/tmp#

apt-get仍然失败并出现403 Forbidden错误。

root@server:/tmp# apt-get update
Ign http://us.archive.ubuntu.com precise Release.gpg
<...snipped excess...>
Ign http://us.archive.ubuntu.com precise-backports/universe TranslationIndex
Err http://security.ubuntu.com precise-security/main Sources
  403  Forbidden [IP: x.x.x.25 8080]
<...snipped excess...>
Err http://security.ubuntu.com precise-security/multiverse i386 Packages
  403  Forbidden [IP: x.x.x.25 8080]
W: Failed to fetch http://us.archive.ubuntu.com/ubuntu/dists/precise/main/source/Sources  403  Forbidden [IP: x.x.x.24 8080]
<...snipped excess...>
W: Failed to fetch http://security.ubuntu.com/ubuntu/dists/precise-security/multiverse/binary-i386/Packages  403  Forbidden [IP: x.x.x.25 8080]
E: Some index files failed to download. They have been ignored, or old ones used instead.
root@server:/tmp#

---

^{PROXY 替换了我的代理服务器的 FQDN}

Answer 1

问题在于报告的user-agent。这就是代理使用 wget 而不是 apt-get 的原因。

我跑去tcpdump -Ai eth0 port 8080查看 http 的样子，并从我们的公司代理处收到了一条“未经批准的用户代理”消息。

<...snip...>
 <h1>ACCESS DENIED</h1>
 <p>The software you are accessing the internet with is not reporting an 
    approved "User-Agent"</p>
<...snip...>

在Ubuntu的联机帮助页有这样的解释，配置参数的部分。

Acquire::http::User-Agent 可用于为 http 下载方法设置不同的 User-Agent，因为某些代理仅在客户端使用已知标识符时才允许客户端访问。

apt-get 307 错误提供了所需的语法，您只需将以下语法添加到/etc/apt/apt.conf.d/30proxy（或您选择的任何内容）。

Acquire::http::User-Agent "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)";

现在，apt-get 更新完美无缺。

root@server:/etc/apt/apt.conf.d# apt-get update
Hit http://security.ubuntu.com precise-security Release.gpg
Hit http://us.archive.ubuntu.com precise Release.gpg
<...snip...>
Hit http://us.archive.ubuntu.com precise-backports/multiverse Translation-en
Hit http://us.archive.ubuntu.com precise-backports/restricted Translation-en
Hit http://us.archive.ubuntu.com precise-backports/universe Translation-en
Reading package lists... Done