How can Ubuntu 26 handle Windows SSH logins using DOMAINusername format with SSSD?
Asked by
MellowCedar47
I'm setting up new Ubuntu 26 servers with SSSD and Active Directory. Authentication works when I use a fully qualified or otherwise adjusted username, but SSH connections from Windows fail with "Permission denied" when the client automatically sends the account in the form DOMAINname.surname.
On Ubuntu 24, the same general SSSD setup worked without requiring users to modify their SSH command. The Windows OpenSSH client is generating the username format automatically, and I'd prefer not to make less-technical users remember to add a different prefix or suffix.
The relevant SSSD settings include the AD identity provider, cached credentials, `use_fully_qualified_names = False`, `access_provider = simple`, and an allowlist of permitted groups. Is there a configuration change or compatibility fix for Ubuntu 26 that will allow logins using the DOMAINusername format?
Answers
You can hide the username formatting requirement with an SSH client configuration. In the user’s `~/.ssh/config`, add a host rule and specify the login name you want SSH to use, for example:
`Host *.your.domain`
` User username@domain`
That way users can connect using only the server name, assuming the host pattern matches.
Reply to this answer
Ubuntu 26 may be using a newer OpenSSH version with stricter username handling. If the Windows client sends `DOMAINuser` but SSSD normalizes that to `user`, sshd may see a mismatch and reject the authentication even though the account is valid. The fix is to make the username format consistent between the Windows client, sshd, and SSSD, or install an OpenSSH/SSSD update that addresses the normalization behavior.
Reply to this answer
Try explicitly setting the login name in the SSH command, for example `ssh -l username@domain servername`. NetBIOS itself is generally best avoided, but this may help distinguish the account format issue from the underlying authentication problem.
Reply to this answer
Check the SSH and SSSD logs first, especially the authentication log and the SSSD domain log. They should show whether the failure happens because the account is rejected by `simple_allow_groups`, because the DOMAINusername form is being normalized, or because the newer SSH stack is rejecting the transformed username.
Reply to this answer
Add your answer
Answers are reviewed before publication.
MellowCedar47: The issue isn’t about enabling NetBIOS services. I’m referring to the SAM-style account name that the Windows OpenSSH client automatically sends, such as DOMAINname.surname.