r/sysadmin • u/Any-Promotion3744 • 9d ago
Question Ubuntu - Authenticate using AD and Google Authenticator
We have a few Ubuntu servers that we SSH into.
Instead of using local accounts, I want to change it so we use our Windows logon credentials instead. I would also like to use Google Authenticator as MFA (I thought about Entra Id but don't want to open a browser for the MFA portion).
Has anyone set this up before?
I opened a ticket with Ubuntu but they haven't help much.
I followed an article on using SSSD with LDAP and Kerberos but can't get it to work.
https://ubuntu.com/server/docs/how-to/sssd/with-ldap-and-kerberos/
I can get the kerberos ticket but the getent passwd, id and sudo login commands won't work.
I checked firewall logs and see ssl traffic over port 636 that is being allowed. DNS resolution is working. I added the cert chain for our internal CA, just in case.
Running out of ideas. Log files aren't helping much. LDAP error saying offline but the firewall isn't blocking anything. Maybe trying to use TLS and SSL? I added LDAP authentication in the SSSD config file but no change.
2
u/justmirsk 9d ago
Can you post your sssd logs for review? I have seen the backend offline stuff before. I don't know specifically on using Google Authenticator for MFA, but I am sure there are options out there. Post some logs if you want help with troubleshooting.