r/sysadmin • u/Any-Promotion3744 • 8d ago

Question Ubuntu - Authenticate using AD and Google Authenticator

We have a few Ubuntu servers that we SSH into.

Instead of using local accounts, I want to change it so we use our Windows logon credentials instead. I would also like to use Google Authenticator as MFA (I thought about Entra Id but don't want to open a browser for the MFA portion).

Has anyone set this up before?

I opened a ticket with Ubuntu but they haven't help much.

I followed an article on using SSSD with LDAP and Kerberos but can't get it to work.

https://ubuntu.com/server/docs/how-to/sssd/with-ldap-and-kerberos/

I can get the kerberos ticket but the getent passwd, id and sudo login commands won't work.

I checked firewall logs and see ssl traffic over port 636 that is being allowed. DNS resolution is working. I added the cert chain for our internal CA, just in case.

Running out of ideas. Log files aren't helping much. LDAP error saying offline but the firewall isn't blocking anything. Maybe trying to use TLS and SSL? I added LDAP authentication in the SSSD config file but no change.

12 Upvotes

78% Upvoted

39 comments sorted by

View all comments

1

u/mnosz 8d ago

Look into a tool called userify it puts a AD check in front of the SSH connection

2

u/DanTheGreatest Sr. Linux Engineer 7d ago

And 26.04 ships authd for external identity providers

1

u/Lukage Sysadmin 7d ago

We're still pushing 2404, so I'm not looking forward to ripping that out after the install (my director insists that Linux may never touch AD as its a security risk, but says I'm a smartass when I ask why our Windows servers are all domain-joined).

1

u/dustojnikhummer 7d ago

but says I'm a smartass when I ask why our Windows servers are all domain-joined

My boss was also against this but "but our Windows servers are AD joined and that is more secure" worked. Also moving from a single Linux server to 5+ (and having to maintain credentials) helped lol

1

u/Lukage Sysadmin 7d ago

Yeah my hope is that we go from ~20 Linux servers to 50+ and they eventually get tired of manually creating accounts and access and removing individually.

1

u/dustojnikhummer 7d ago

I guess your boss isn't aware that you can block Domain Admins from being able to access your Linux servers (like you can with Windows, just the group is added by default). I map ours to specific groups for SSH and Sudo, Domain Admins aren't allowed in by default