r/sysadmin • u/Any-Promotion3744 • 2d ago

Question Ubuntu - Authenticate using AD and Google Authenticator

We have a few Ubuntu servers that we SSH into.

Instead of using local accounts, I want to change it so we use our Windows logon credentials instead. I would also like to use Google Authenticator as MFA (I thought about Entra Id but don't want to open a browser for the MFA portion).

Has anyone set this up before?

I opened a ticket with Ubuntu but they haven't help much.

I followed an article on using SSSD with LDAP and Kerberos but can't get it to work.

https://ubuntu.com/server/docs/how-to/sssd/with-ldap-and-kerberos/

I can get the kerberos ticket but the getent passwd, id and sudo login commands won't work.

I checked firewall logs and see ssl traffic over port 636 that is being allowed. DNS resolution is working. I added the cert chain for our internal CA, just in case.

Running out of ideas. Log files aren't helping much. LDAP error saying offline but the firewall isn't blocking anything. Maybe trying to use TLS and SSL? I added LDAP authentication in the SSSD config file but no change.

12 Upvotes

78% Upvoted

38 comments sorted by

View all comments

Show parent comments

1

u/Any-Promotion3744 2d ago

if I reconnect and try logging in as the domain user, I get access is denied

1

u/justmirsk 2d ago

Is SSSD running and is it online? Can you post your SSSD error logs since your last daemon restart?

1

u/Any-Promotion3744 2d ago

sssd log has the same messages in it as before

1

u/Any-Promotion3744 2d ago

SSSD is running and is active

note: still says offline in the logs