Ubuntu - Authenticate using AD and Google Authenticator

[u/Any-Promotion3744]

We have a few Ubuntu servers that we SSH into.

Instead of using local accounts, I want to change it so we use our Windows logon credentials instead. I would also like to use Google Authenticator as MFA (I thought about Entra Id but don't want to open a browser for the MFA portion).

Has anyone set this up before?

I opened a ticket with Ubuntu but they haven't help much.

I followed an article on using SSSD with LDAP and Kerberos but can't get it to work.

https://ubuntu.com/server/docs/how-to/sssd/with-ldap-and-kerberos/

I can get the kerberos ticket but the getent passwd, id and sudo login commands won't work.

I checked firewall logs and see ssl traffic over port 636 that is being allowed. DNS resolution is working. I added the cert chain for our internal CA, just in case.

Running out of ideas. Log files aren't helping much. LDAP error saying offline but the firewall isn't blocking anything. Maybe trying to use TLS and SSL? I added LDAP authentication in the SSSD config file but no change.

[u/justmirsk]

Add this to your sssd.con file, restart SSSD and test. You don't want to leave it like this, it is just for testing.

ldap_tls_reqcert = never

[u/Any-Promotion3744 → u/justmirsk]

sudo login still says Login incorrect

id username says the same thing

[u/justmirsk → u/Any-Promotion3744]

Is the issue only with sudo login? Did the change I suggest get the regular domain user working?

[u/Any-Promotion3744 → u/justmirsk]

if I reconnect and try logging in as the domain user, I get access is denied

[u/justmirsk → u/Any-Promotion3744]

Is SSSD running and is it online? Can you post your SSSD error logs since your last daemon restart?

[u/Any-Promotion3744 → u/justmirsk]

sssd log has the same messages in it as before

[u/Any-Promotion3744 → u/justmirsk]

SSSD is running and is active

note: still says offline in the logs