Crouton: Installing behind the Great Firewall of China, proxy problem

[JoakimP1]

Hello, for clarification Im working in China. So battling and using proxies against gfw is business as usual.

Google login is blocked but there was no problem getting around it the normal way.
Downloading and installing any linux distros through crouton was another issue.

This is my progress so far.

No proxy:

Get:68 http://archive.ubuntu.com precise-updates/main Translation-en [219 kB]
Fetched 27.6 MB in 6min 37s (69.6 kB/s)
W: Failed to fetch gzip:/var/lib/apt/lists/partial/archive.ubuntu.com_ubuntu_dists_precise_universe_source_Sources Hash Sum mismatch

W: Failed to fetch http://archive.ubuntu.com/ubuntu/dists/precise-updates/multiverse/i18n/Index

W: Failed to fetch gzip:/var/lib/apt/lists/partial/archive.ubuntu.com_ubuntu_dists_precise-security_universe_source_Sources Hash Sum mismatch

W: Failed to fetch bzip2:/var/lib/apt/lists/partial/archive.ubuntu.com_ubuntu_dists_precise-security_universe_binary-i386_Packages Hash Sum mismatch

E: Some index files failed to download. They have been ignored, or old ones used instead.
Failed to complete chroot setup.
Unmounting /mnt/stateful_partition/crouton/chroots/precise...

http://askubuntu.com/questions/41605/trouble-downloading-updates-due-to-a-hash-sum-mismatch-error did not work. Same error
I just assume this error is due to the firewall fucking with me, since all the partial answers on the net seams to point to connection errors.

So I tried to use proxies instead, and the short explanation is that they either dont respect the credentials I provide or straight out dont connect at all.

Using a socks proxy without auth
Configured in Chrome, and it works.
Curl the apt-get failing links through the proxy, works.
Using Apt-get, does not work

Installing target core...
Preparing environment...
Preparing software sources...
Ign http://archive.ubuntu.com precise InRelease
Ign http://archive.ubuntu.com precise-updates InRelease
Ign http://archive.ubuntu.com precise-security InRelease
Err http://archive.ubuntu.com precise Release.gpg
Connection failed
Err http://archive.ubuntu.com precise-updates Release.gpg
Connection failed
Err http://archive.ubuntu.com precise-security Release.gpg
Connection failed

curl -v --proxy "socks://192.168.1.100:8080" http://archive.ubuntu.com precise Release.gpg

• About to connect() to proxy 192.168.1.100 port 8080 (#0)
• Trying 192.168.1.100...
• Adding handle: conn: 0x7f7e19bcd9c0
• Adding handle: send: 0
• Adding handle: recv: 0
• Curl_addHandleToPipeline: length: 1
• - Conn 0 (0x7f7e19bcd9c0) send_pipe: 1, recv_pipe: 0
• SOCKS4 request granted.
• Connected to 192.168.1.100 (192.168.1.100) port 8080 (#0)

GET / HTTP/1.1
User-Agent: curl/7.31.0
Host: archive.ubuntu.com
Accept: _/_

< HTTP/1.1 200 OK
< Date: Sun, 26 Oct 2014 05:40:38 GMT

• Server Apache/2.2.22 (Ubuntu) is not blacklisted
  < Server: Apache/2.2.22 (Ubuntu)
  < Vary: Accept-Encoding
  < Content-Length: 671
  < Content-Type: text/html;charset=UTF-8

Using a http proxy with a user name and password gives the following error:

Ign http://archive.ubuntu.com precise-security/universe TranslationIndex
Err http://archive.ubuntu.com precise/universe Sources
407 Proxy Authentication Required

The password and username is correkt, it works in curl and in chrome. I checked the /etc/apt/apt.conf.d/80crutonproxy

Acquire::http::proxy "http://user:[email protected]:1337/";
Acquire::ftp::proxy "http://user:[email protected]:1337/";
Acquire::https::proxy "http://user:[email protected]:1337/";

Which is correct. But Im still denied due to lack of correct authentication. Trust me on this, I dubbel/tripple/hexa checked that there is no typos.

chronos@localhost /mnt/stateful_partition/crouton/chroots $ sudo sh ~/Downloads/crouton -n bajs -t xfce -P'socks://192.168.1.100:8081'
Installing precise-amd64 chroot to /usr/local/chroots/bajs
Downloading latest debootstrap...
Error parsing proxy URL socks://192.168.1.100:8081: Unsupported scheme 'socks'.
Download from Debian gitweb failed. Trying latest release...
Error parsing proxy URL socks://192.168.1.100:8081: Unsupported scheme 'socks'.
Failed to download debootstrap.
Check your internet connection or proxy settings and try again.

chronos@localhost /mnt/stateful_partition/crouton/chroots $ sudo sh ~/Downloads/crouton -t xfce -n bajs -P'http://user:[email protected]:1337/'
Installing precise-amd64 chroot to /usr/local/chroots/bajs
Downloading latest debootstrap...
http://anonscm.debian.org/gitweb/?p=d-i/debootstrap.git;a=snapshot;h=HEAD;sf=tgz:
2014-10-26 14:48:32 ERROR 407: Proxy Authentication Required.
Download from Debian gitweb failed. Trying latest release...
http://ftp.debian.org/debian/pool/main/d/debootstrap/:
2014-10-26 14:48:32 ERROR 407: Proxy Authentication Required.
Failed to download debootstrap.
Check your internet connection or proxy settings and try again.
chronos@localhost /mnt/stateful_partition/crouton/chroots $

[tonyxue]

Great to see another user in China and I am Chinese so I could tell you how
did I get around it.

First of all, if you use proxy just for getting out of the firewall for installing crouton, there is actually a simpler and faster way.

1. Use a mirror for apt and assign it use -m with crouton directly.
   Here's some of the mirrors I use frequently in China:
   mirrors.163.com
   mirrors.sohu.com
   mirrors.ustc.edu.cn
   mirror.bjtu.edu.cn
2. Set hosts for chroot
   After finishing downloading the main components of the distro, you can
   directly edit the hosts file inside the chroot file system folder and add
   203.208.46.195 for chromium.googlesource.com.

The ip is Google's Beijing IP(you can check) and it is not scanned by the
filtering system since it is domestic traffic.

If you just want to use that proxy, obviously the type of authentication used by the proxy server is not supported.

[JoakimP1]

Thanks @tonyxue.

I retried everything on my office network which is more stable, and I did not get the checksum errors anymore. So I think I can deduce that it was just my crappy dsl or some gov filtering stuff that messed with me.

For the hosts edit, I have no luck. I ran the installation without that update and it crashed as soon as it tried to call google. So I added it to the hosts and now I get this instead.

--2014-10-28 13:25:25-- https://chromium.googlesource.com/chromiumos/third_party/adhd/+refs/heads?format=TEXT
Resolving chromium.googlesource.com (chromium.googlesource.com)... 203.208.46.195
Connecting to chromium.googlesource.com (chromium.googlesource.com)|203.208.46.195|:443... connected.
ERROR: no certificate subject alternative name matches
requested host name chromium.googlesource.com'. To connect to chromium.googlesource.com insecurely, use--no-check-certificate'.

I haven't tried yet to reinstall, but will see if it makes any difference

[JoakimP1]

@tonyxue After a fresh install on a stable network, without any proxy, and with the added hosts entry before the install, worked perfectly. Thanks for the help.

[tonyxue]

@JoakimP1 I think the hash mismatch issue is a purely network one. Maybe something got corrupted.

[liuzeyafzy]

Sadly, ip address "203.208.46.195" is not reachable now.
More unfortunately, we can barely use VPN now.
It is not helping in spite of ss is still working.
@dnschneid Really Really need your help.

[yw10]

Thanks @tonyxue
It works on my HP Chromebook 11,

[liuzeyafzy]

The way I solved the problem is that, using cisco VPN.
I bought a linode vps, build a cisco vpn server. My mac link the vpn and share the Internet with chromebook by wifi.
After you passed the authentication, cisco VPN is no necessary.

simplified chinese version:
我是通过cisco vpn来完成crouton的安装的。
首先在linode上购买一个vps服务器，搭建cisco vpn（不一定要linode，linux内核支持cisco的就行，搭建脚本github上面就有，操作简单）。
然后通过mac连接cisco vpn，再共享wifi给chromebook。
此时chromebook就可以正常安装了。
仅授权那一下需要vpn，其他下载不需要，ctrl + c取消命令后重新下载。（因为vpn可能速度慢）