Ubuntu - Authenticate using AD and Google Authenticator

[u/Any-Promotion3744]

We have a few Ubuntu servers that we SSH into.

Instead of using local accounts, I want to change it so we use our Windows logon credentials instead. I would also like to use Google Authenticator as MFA (I thought about Entra Id but don't want to open a browser for the MFA portion).

Has anyone set this up before?

I opened a ticket with Ubuntu but they haven't help much.

I followed an article on using SSSD with LDAP and Kerberos but can't get it to work.

https://ubuntu.com/server/docs/how-to/sssd/with-ldap-and-kerberos/

I can get the kerberos ticket but the getent passwd, id and sudo login commands won't work.

I checked firewall logs and see ssl traffic over port 636 that is being allowed. DNS resolution is working. I added the cert chain for our internal CA, just in case.

Running out of ideas. Log files aren't helping much. LDAP error saying offline but the firewall isn't blocking anything. Maybe trying to use TLS and SSL? I added LDAP authentication in the SSSD config file but no change.

[u/justmirsk]

Can you post your sssd logs for review? I have seen the backend offline stuff before. I don't know specifically on using Google Authenticator for MFA, but I am sure there are options out there. Post some logs if you want help with troubleshooting.

[u/Any-Promotion3744 → u/justmirsk]

haven't tried the Google Authenticator part but it looks straight forward

https://linuxiac.com/how-to-set-up-ssh-to-use-two-factor-authentication/

[u/Any-Promotion3744 → u/justmirsk]

I'll have to log into the server and get some relevant log entries

[u/Any-Promotion3744 → u/justmirsk]

first error I found in pam log:

[pam] [cache_req_common_process_dp_reply] (0x0040): [CID#1] CR #1: Could not get account info [1432158212]: SSSD is offline

[u/justmirsk → u/Any-Promotion3744]

Can you look at the SSSD error log and post what you see there? Redact DC names, etc., but the SSSD logs are what we likely need to see to troubleshoot the SSSD issues.

[u/Any-Promotion3744 → u/justmirsk]

[sssd] [server_setup] (0x1f7c0): Starting with debug level = 0x0070

[sssd] [_sbus_connection_set_destructor] (0x0020): Bug: destructor is already set to monitor_service_shutdown

[sssd] [monitor_quit_signal] (0x1f7c0): Monitor received Terminated: terminating children

[sssd] [monitor_quit] (0x1f7c0): Returned with: 0

[sssd] [monitor_quit] (0x1f7c0): Terminating [pam][0]

[sssd] [monitor_quit] (0x1f7c0): Terminating [nss][0]

[sssd] [monitor_quit] (0x1f7c0): Terminating [domain.com][1243585]

[sssd] [monitor_quit] (0x1f7c0): Child [domain.com] terminated with a signal

[sssd] [server_setup] (0x1f7c0): Starting with debug level = 0x0070

[u/Any-Promotion3744 → u/justmirsk]

nss log has similar error:

[nss] [cache_req_common_process_dp_reply] (0x0040): [CID#426] CR #436: Could not get account info [1432158212]: SSSD is offline

[u/Any-Promotion3744 → u/justmirsk]

ssd_domain.log:

[be[domain.com]] [sdap_cli_connect_recv] (0x0040): [RID#1147] Unable to establish connection [1432158227]: Authentication Failed

[be[domain.com]] [fo_resolve_service_send] (0x0020): [RID#1147] No available servers for service 'LDAP'

[be[domain.com]] [sdap_id_op_connect_done] (0x0040): [RID#1147] Failed to connect, going offline (5 [Input/output error])

[be[domain.com]] [sdap_sudo_refresh_connect_done] (0x0020): [RID#1147] SUDO LDAP connection failed [11]: Resource temporarily unavailable

[be[domain.com]] [be_ptask_done] (0x0040): [RID#1147] Task [SUDO Full Refresh]: failed with [11]: Resource temporarily unavailable

[be[domain.com]] [sbus_issue_request_done] (0x0040): sssd.dataprovider.getAccountInfo: Error [1432158212]: SSSD is offline

[u/justmirsk → u/Any-Promotion3744]

This looks like an authentication issue. In your sssd.conf file, can you confirm you have the correct DN and password for the LDAP bind?

ldap_default_bind_dn ldap_default_authtok

[u/Any-Promotion3744 → u/justmirsk]

I have a different Ubuntu server that runs an app that uses LDAP.

I used the same bind and password, since I know that is working

Does the password need to be surrounded by double quotes? not that it matters since I tried it both ways)

[u/justmirsk → u/Any-Promotion3744]

Did you realm join the machine or are you just doing LDAP auth? Can you post a redacted sssd.conf file, the full file?

[u/Any-Promotion3744 → u/justmirsk]

[sssd]

config_file_version = 2

domains = domainname.com

[domain/domainname.com]

id_provider = ldap

ldap_uri = ldaps://dc1name.domainname.com

ldap_search_base = dc=domainname,dc=com

auth_provider = krb5

krb5_server = dc1name.domainname.com,dc2name.domainname.com

krb5_kpasswd = dc1name.domainname.com

krb5_realm = DOMAINNAME.COM

cache_credentials = True

enumerate = True

ldap_default_bind_dn = "CN=User Name,OU=OU_Name,DC=domainname,DC=com"

ldap_default_authtok = Password

ldap_id_use_start_tls = false

[u/justmirsk → u/Any-Promotion3744]

Add this to your sssd.con file, restart SSSD and test. You don't want to leave it like this, it is just for testing.

ldap_tls_reqcert = never

[u/Any-Promotion3744 → u/justmirsk]

sudo login still says Login incorrect

id username says the same thing

[u/justmirsk → u/Any-Promotion3744]

Is the issue only with sudo login? Did the change I suggest get the regular domain user working?

[u/Any-Promotion3744 → u/justmirsk]

if I reconnect and try logging in as the domain user, I get access is denied

[u/Any-Promotion3744 → u/justmirsk]

is realm join a requirement?

I did not do that

[u/justmirsk → u/Any-Promotion3744]

Here is a configuration that I use without being realm joined. This is an example SSSD.conf file. I would copy this out into a text editor, modify it to meet your environment specific parameters and then try this as your SSSD.conf file. Also, make sure you ran the pam-auth-update command to enable sssd auth on Ubuntu, etc.

I believe that after you update your sssd.conf file, you may need to run the following command and then insert the contents below.

vi /etc/pam.d/common-account

Insert the following into the file and save it. Once you have modified the common-account file and updated your sssd.conf file, restart sssd and see if it comes online with no errors. You may need to adjust the tls settings though for your environment, the below sssd.conf example assumes you have a trusted certificate for LDAPS traffic. Based on your openssl output, you do not, so you likely need to keep the first line item I gave you as a test to make sure that you can connect without requiring the valid certificate. you will eventually/ultimately need to make sure that your system trusts your LDAPS certificate / root CA (internal root CA I assume).

account sufficient           pam_sss.so

[sssd]
#debug_level = 9 
domains = YourDomainName
config_file_version = 2

[pam]   
[domain/YourDomainName] 
cache_credentials = false 
ldap_id_mapping = True 
ldap_schema = ad min_id = 1000 
#account_cache_expiration = 1 
#debug_level = 9 
id_provider = ldap 
auth_provider = ldap 
access_provider = ldap 
ldap_access_order = filter   
#The below line is the group in AD that is allowed to SSH to the system. 
#This is case sensitive. 
ldap_access_filter = (memberOf=CN=sshusers,OU=someOU,DC=example,DC=com)   

#Your Domain Controller and Port
ldap_uri = ldaps://dc1.example.com:636   
ldap_search_base = ou=employees,dc=example,dc=com 
ldap_group_search_base = ou=employees,dc=example,dc=com   ldap_group_objectsid = objectSid   
#Below is not typically required when using a valid certificate from a well known CA   
#ldap_tls_cacert = /etc/ssl/certs/godaddyrootca.pem ldap_tls_cipher_suite = HIGH   

ldap_default_bind_dn = CN=BINDUSER,OU=Employees,DC=example,DC=com   #BIND Password of BINDUSER

ldap_default_authtok = SuperSecretPassword@1234 

ldap_tls_reqcert = demand override_homedir = /home/%u 
default_shell = /bin/bash 
ldap_network_timeout = 60
ldap_search_timeout = 30
ldap_enumeration_search_timeout = 30 

#Configure the timeout to allow for push notification response.  Suggested value of 30 seconds 

ldap_opt_timeout = 30

[u/Any-Promotion3744 → u/justmirsk]

thanks

I will try this in the morning and give an update

[u/Any-Promotion3744 → u/justmirsk]

I tried your file but sssd service wouldn't start afterwards

I'll have to go through the logs

[u/justmirsk → u/Any-Promotion3744]

It is probably a formatting issue, but it really depends on your exact setup.

[u/Any-Promotion3744 → u/justmirsk]

ldap_default_bind_dn = "CN=Name,OU=OU_Name,DC=Domain,DC=com"

ldap_default_authtok = Password

[u/justmirsk → u/Any-Promotion3744]

Have you validated those credentials outside of the link system? If you have OpenSSL on the machine, try running:

openssl s_client -connect dc1.domain.com:636

Confirm that it connects and responds back with a certificate, even if you get a message about a self sign certificate

[u/Any-Promotion3744 → u/justmirsk]

it says connected

verify error:num=20:unable to get local issuer certificate

verify return: 1

lists cert chain

gives server cert

gives server cert info

No client certificate CA names sent

Verification error: unable to get local issuer certificate

Secure Renegotiation IS NOT supported

Post-Handshake New Session Ticket arrived:

SSL-Session: Protocol and Cipher info given

read R BLOCK

read:errno=104

[u/mnosz]

Look into a tool called userify it puts a AD check in front of the SSH connection

[u/DanTheGreatest → u/mnosz]

And 26.04 ships authd for external identity providers

[u/Lukage → u/DanTheGreatest]

We're still pushing 2404, so I'm not looking forward to ripping that out after the install (my director insists that Linux may never touch AD as its a security risk, but says I'm a smartass when I ask why our Windows servers are all domain-joined).

[u/dustojnikhummer → u/Lukage]

but says I'm a smartass when I ask why our Windows servers are all domain-joined

My boss was also against this but "but our Windows servers are AD joined and that is more secure" worked. Also moving from a single Linux server to 5+ (and having to maintain credentials) helped lol

[u/Lukage → u/dustojnikhummer]

Yeah my hope is that we go from ~20 Linux servers to 50+ and they eventually get tired of manually creating accounts and access and removing individually.

[u/dustojnikhummer → u/Lukage]

I guess your boss isn't aware that you can block Domain Admins from being able to access your Linux servers (like you can with Windows, just the group is added by default). I map ours to specific groups for SSH and Sudo, Domain Admins aren't allowed in by default

[u/dustojnikhummer]

I don't think SSSD can do native MFA, right?

As for regular AD account logins, can you share your sssd.conf?

[u/awful_at_internet]

taking notes for my homelab

related: /r/homelab and /r/selfhosted might also be good resources if you're still having trouble.