How to fix E: Failed to fetch URL 407 Proxy Authentication Required in APT

APTINTERMEDIATEMEDIUMUpdated Dec 29, 2025· 209 views

apt cannot authenticate with a proxy server when fetching packages. This occurs when apt is configured to use a proxy but lacks valid authentication credentials.

Quick fix

Fixes E: Failed to fetch URL 407 Proxy Authentication Required

sudo grep -r "Acquire::.*::Proxy" /etc/apt/
  1. Verify current APT proxy configuration
  2. Add authentication credentials to APT proxy
  3. Handle special characters in password
  4. Test the configuration
apt — error
sudo grep -r "Acquire::.*::Proxy" /etc/apt/
E: Failed to fetch URL 407 Proxy Authentication Required

What this error means

The HTTP 407 Proxy Authentication Required error indicates that your system is behind a proxy server that requires authentication. When apt attempts to fetch packages through this proxy, the proxy server rejects the request because authentication details are missing or incorrect. This commonly happens in corporate environments with proxy servers, especially Microsoft ISA or NTLM-based proxies.

Typical symptoms

  • apt update or apt install commands fail with "407 Proxy Authentication Required" error
  • Package installation hangs or fails when accessing repositories
  • apt-get works fine without proxy but fails when configured to use one
  • Error appears even though proxy server is accessible

Common causes

  1. APT proxy configuration missing username and password credentials
  2. Proxy credentials incorrect or expired
  3. Special characters in password not URL-encoded in apt configuration
  4. Using HTTP proxy for HTTPS repositories (protocol mismatch)
  5. NTLM or ISA proxy server requiring specialized authentication handlers

How to fix "E: Failed to fetch URL 407 Proxy Authentication Required"

1Verify current APT proxy configuration

Check if apt has proxy settings configured:

bash
sudo grep -r "Acquire::.*::Proxy" /etc/apt/

This will show any existing proxy configurations. If you see a proxy without credentials, that's likely the issue.

2Add authentication credentials to APT proxy

Edit the APT configuration file:

bash
sudo nano /etc/apt/apt.conf.d/99apt-proxy

Add proxy settings with credentials in this format (note the trailing slash):

bash
Acquire::http::Proxy "http://username:password@proxyserver:port/";
Acquire::https::Proxy "https://username:password@proxyserver:port/";

Replace:
- username with your proxy username
- password with your proxy password
- proxyserver with the proxy server hostname or IP
- port with the proxy port (usually 8080 or 3128)

Save the file (Ctrl+O, Enter, Ctrl+X).

3Handle special characters in password

If your password contains special characters (like @, #, %, etc.), URL-encode them:

- @ becomes %40
- # becomes %23
- % becomes %25
- : becomes %3A
- / becomes %2F

Example: password Pass@123# becomes Pass%40123%23:

bash
Acquire::http::Proxy "http://user:Pass%40123%23@proxy.example.com:8080/";
4Test the configuration

Clear apt cache and attempt an update:

bash
sudo apt-get clean
sudo apt-get update

If it succeeds, the proxy authentication is now configured correctly. Try installing a package to confirm:

bash
sudo apt-get install curl
5For NTLM/ISA proxies, use cntlm as a local relay

If you're using a Microsoft ISA or NTLM-based proxy, apt may not support NTLM authentication directly. Use cntlm as a local authentication relay:

bash
sudo apt-get install cntlm
sudo nano /etc/cntlm.conf

Configure with your credentials:

bash
Username username
Domain DOMAIN
Password yourpassword
Proxy proxy.example.com:8080
Listen 3128

Then restart cntlm and point apt to localhost:

bash
sudo systemctl restart cntlm

Add to apt config:

bash
Acquire::http::Proxy "http://localhost:3128/";

No authentication needed for localhost since cntlm handles it.

6Verify proxy connectivity directly

Test if the proxy is reachable and your credentials work:

bash
curl -x http://username:password@proxyserver:port/ -I http://archive.ubuntu.com

If you get a 407 error, the credentials are incorrect. If you get a 200 response, the proxy is accessible and auth works. This helps isolate whether the issue is with apt configuration or the proxy itself.

Advanced notes

For environment-specific proxy settings without modifying system-wide files, you can set proxy variables before running apt commands:

bash
http_proxy="http://user:pass@proxy:port/" apt-get update

Or add to ~/.bashrc for persistent per-user settings:

bash
export http_proxy="http://user:pass@proxy:port/"
export https_proxy="https://user:pass@proxy:port/"

In Docker, pass proxy settings during build: docker build --build-arg http_proxy=http://user:pass@proxy:port/ .

For Debian/Ubuntu systems behind corporate proxies, ensure you're not mixing HTTP and HTTPS proxies inconsistently, as some repositories may only be available over HTTPS.

Frequently asked questions

What does "E: Failed to fetch URL 407 Proxy Authentication Required" mean?
The HTTP 407 Proxy Authentication Required error indicates that your system is behind a proxy server that requires authentication. When apt attempts to fetch packages through this proxy, the proxy server rejects the request because authentication details are missing or incorrect. This commonly happens in corporate environments with proxy servers, especially Microsoft ISA or NTLM-based proxies.
How do I fix "E: Failed to fetch URL 407 Proxy Authentication Required"?
apt cannot authenticate with a proxy server when fetching packages. This occurs when apt is configured to use a proxy but lacks valid authentication credentials.
What causes "E: Failed to fetch URL 407 Proxy Authentication Required"?
APT proxy configuration missing username and password credentials Proxy credentials incorrect or expired Special characters in password not URL-encoded in apt configuration
Is the "E: Failed to fetch URL 407 Proxy Authentication Required" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading