apt cannot authenticate with a proxy server when fetching packages. This occurs when apt is configured to use a proxy but lacks valid authentication credentials.
The HTTP 407 Proxy Authentication Required error indicates that your system is behind a proxy server that requires authentication. When apt attempts to fetch packages through this proxy, the proxy server rejects the request because authentication details are missing or incorrect. This commonly happens in corporate environments with proxy servers, especially Microsoft ISA or NTLM-based proxies.
Check if apt has proxy settings configured:
sudo grep -r "Acquire::.*::Proxy" /etc/apt/This will show any existing proxy configurations. If you see a proxy without credentials, that's likely the issue.
Edit the APT configuration file:
sudo nano /etc/apt/apt.conf.d/99apt-proxyAdd proxy settings with credentials in this format (note the trailing slash):
Acquire::http::Proxy "http://username:password@proxyserver:port/";
Acquire::https::Proxy "https://username:password@proxyserver:port/";Replace:
- username with your proxy username
- password with your proxy password
- proxyserver with the proxy server hostname or IP
- port with the proxy port (usually 8080 or 3128)
Save the file (Ctrl+O, Enter, Ctrl+X).
If your password contains special characters (like @, #, %, etc.), URL-encode them:
- @ becomes %40
- # becomes %23
- % becomes %25
- : becomes %3A
- / becomes %2F
Example: password Pass@123# becomes Pass%40123%23:
Acquire::http::Proxy "http://user:Pass%40123%[email protected]:8080/";Clear apt cache and attempt an update:
sudo apt-get clean
sudo apt-get updateIf it succeeds, the proxy authentication is now configured correctly. Try installing a package to confirm:
sudo apt-get install curlIf you're using a Microsoft ISA or NTLM-based proxy, apt may not support NTLM authentication directly. Use cntlm as a local authentication relay:
sudo apt-get install cntlm
sudo nano /etc/cntlm.confConfigure with your credentials:
Username username
Domain DOMAIN
Password yourpassword
Proxy proxy.example.com:8080
Listen 3128Then restart cntlm and point apt to localhost:
sudo systemctl restart cntlmAdd to apt config:
Acquire::http::Proxy "http://localhost:3128/";No authentication needed for localhost since cntlm handles it.
Test if the proxy is reachable and your credentials work:
curl -x http://username:password@proxyserver:port/ -I http://archive.ubuntu.comIf you get a 407 error, the credentials are incorrect. If you get a 200 response, the proxy is accessible and auth works. This helps isolate whether the issue is with apt configuration or the proxy itself.
For environment-specific proxy settings without modifying system-wide files, you can set proxy variables before running apt commands:
http_proxy="http://user:pass@proxy:port/" apt-get updateOr add to ~/.bashrc for persistent per-user settings:
export http_proxy="http://user:pass@proxy:port/"
export https_proxy="https://user:pass@proxy:port/"In Docker, pass proxy settings during build: docker build --build-arg http_proxy=http://user:pass@proxy:port/ .
For Debian/Ubuntu systems behind corporate proxies, ensure you're not mixing HTTP and HTTPS proxies inconsistently, as some repositories may only be available over HTTPS.
E: Could not connect to proxy server
Could not connect to proxy server
E: Package 'package:i386' has no installation candidate
How to fix "Package package:i386 has no installation candidate" in apt
E: The value 'value' is invalid for APT::Default-Release
How to fix invalid APT::Default-Release value in APT
dpkg: error: unable to create new file 'path': Permission denied
How to fix dpkg permission denied errors in APT
subprocess installed post-removal script returned error exit status 1
How to fix "subprocess installed post-removal script returned error exit status 1" in APT