Enable SSH Logins Using Microsoft Entra ID Credentials and Rublon MFA

Microsoft Entra ID is often the central identity source for an organization, but Linux servers cannot normally use Entra ID credentials directly for standard SSH password authentication. OpenSSH relies on the authentication mechanisms available on the Linux host, while Microsoft Entra ID is not a traditional LDAP directory or a native SSH password authentication service.

Rublon Authentication Proxy can bridge this gap. The Debian server sends the password authentication request to Rublon Authentication Proxy, which verifies the user’s credentials against Microsoft Entra ID and requires Rublon MFA before granting SSH access.

This configuration enables users to sign in to SSH with:

• their local Linux username,
• the password associated with their Microsoft Entra ID account,
• an additional authentication step provided by Rublon MFA.

The resulting SSH session still runs as an existing local Linux account. Microsoft Entra ID verifies the primary credentials, while Debian continues to provide the user’s UID, GID, home directory, login shell, file ownership, and other operating-system attributes. 

Use Microsoft Entra ID Credentials for SSH Logins

Organizations that use Microsoft Entra ID as their primary identity platform may still have Linux servers that authenticate users through local passwords, SSH keys, Active Directory, or another external directory.

With Rublon Authentication Proxy, selected SSH password logins can use Microsoft Entra ID as the primary authentication source. Users enter the password associated with their Entra ID account, and Rublon MFA adds another verification step before the SSH session is opened.

This approach makes it possible to:

• enable SSH password logins with Microsoft Entra ID credentials,
• add multi-factor authentication to the same SSH login flow,
• use Entra ID without joining the Debian server to an Active Directory domain,
• avoid maintaining a separate password for the selected SSH authentication path,
• apply the integration specifically to OpenSSH without changing every PAM-enabled service,
• keep local Linux account attributes and permissions unchanged,
• preserve SSH public key authentication as an independent access method.

Microsoft Entra ID is used for primary password verification, while Rublon MFA provides the additional authentication step. Rublon Authentication Proxy acts as the intermediary between the PAM-based SSH login and Microsoft Entra ID.

Add MFA to SSH Password Authentication

SSH provides encrypted remote access, but encryption alone does not prevent an attacker from signing in with a valid stolen or compromised password.

Passwords can be exposed through credential theft, password reuse, malware, social engineering, or administrative mistakes. When password authentication is enabled, possession of the correct password may otherwise be sufficient to access the server.

Rublon MFA adds a separate verification step to the SSH password login. Even when the primary password is compromised, the authentication attempt must still satisfy the organization’s Rublon access policy and complete an enabled authentication method.

In the configuration described in this guide:

1. OpenSSH collects the user’s password.
2. PAM passes the authentication request to an example mapping script.
3. The script maps the local Linux username to a Microsoft Entra ID UPN.
4. Rublon Authentication Proxy verifies the password against Microsoft Entra ID.
5. Rublon MFA requires additional authentication.
6. OpenSSH grants access only after the complete authentication flow succeeds.

Extend an Entra-First Identity Strategy to Linux SSH Access

Organizations moving toward an Entra-first identity architecture may still depend on authentication mechanisms that Microsoft Entra ID does not support directly.

SSH password authentication is one such scenario. A standard Debian server cannot submit an SSH password directly to Microsoft Entra ID in the same way that a modern web application can redirect a user to an OAuth 2.0, OpenID Connect, or SAML identity provider.

Rublon Authentication Proxy enables the PAM authentication flow to use Microsoft Entra ID as its primary authentication source. This allows organizations to extend Entra ID credentials and Rublon MFA to Linux SSH access without replacing OpenSSH or changing the server into a web-based authentication client.

This approach is especially relevant when:

• Microsoft Entra ID is already the organization’s main identity source,
• selected Linux servers still permit SSH password authentication,
• users should not maintain a separate local password for that SSH login path,
• the organization wants to add MFA to SSH password access,
• the Linux server must continue using local accounts for system-level identity data,
• only the SSH PAM service should be changed,
• existing SSH public key access must remain available.

Rublon Authentication Proxy similarly allows LDAP and RADIUS clients to use Microsoft Entra ID credentials when they cannot integrate with Entra ID through modern identity protocols.

What This SSH and Entra ID Integration Does

This configuration changes how OpenSSH verifies passwords. It does not replace the Linux user database or automatically create operating-system accounts from Microsoft Entra ID.

For every user, two identities remain involved:

Identity	Example	Purpose
Local Linux account	alice	Provides the UID, GID, home directory, shell, permissions, and session identity
Microsoft Entra ID account	alice@example.com	Provides the password used for primary authentication

The example PAM helper maps:

alice

to:

alice@example.com

Authentication succeeds only when:

1. the local Linux account exists,
2. the Microsoft Entra ID password is valid,
3. the Rublon MFA authentication succeeds,
4. the PAM account and session checks allow access.

This means that the configuration does not:

• join Debian to Microsoft Entra ID,
• provision local Linux accounts from Entra ID,
• obtain UID or GID values from Entra ID,
• modify authorization or file permissions,
• automatically protect SSH public key authentication,
• change authentication for every PAM-enabled service.

Why Use Microsoft Entra ID Credentials for SSH Logins?

Organizations increasingly use Microsoft Entra ID as their primary identity directory, but Linux servers normally continue to authenticate local accounts through PAM, local password databases, LDAP directories, or SSH keys.

Microsoft Entra ID is not a traditional LDAP server, so a Linux host cannot simply bind to it as it would bind to Active Directory or OpenLDAP. Rublon Authentication Proxy solves this problem by exposing an LDAP endpoint and using Microsoft Entra ID as the underlying authentication source.

This approach can help organizations:

• use Entra ID passwords for selected Linux login paths,
• add Rublon MFA to SSH password authentication,
• avoid changing authentication globally for every PAM-enabled service,
• preserve existing local Linux account attributes,
• maintain SSH public key access as a separate authentication method,
• extend Entra-first identity strategies to systems that do not support modern identity protocols directly.

How SSH Login With Microsoft Entra ID Credentials and MFA Works

The user enters a local Linux username, such as alice. The example PAM helper converts that username into the corresponding Microsoft Entra ID User Principal Name, such as alice@example.com.

The authentication process consists of the following steps:

1. The user starts an SSH password login with the local Linux username.
2. OpenSSH invokes the PAM configuration for the sshd service.
3. PAM starts the example mapping script and passes the username and password to it.
4. The script verifies that the Linux account can be resolved through the system NSS user database.
5. The script maps the local username, such as alice, to the Entra ID UPN alice@example.com.
6. The script establishes an LDAPS connection to Rublon Authentication Proxy.
7. Rublon Authentication Proxy verifies the password against Microsoft Entra ID.
8. Rublon MFA requires the user to complete an additional authentication step.
9. The result is returned through Rublon Authentication Proxy, the helper script, and PAM.
10. OpenSSH starts the session as the local Linux user alice.

The Entra ID account provides primary password verification, while the local Linux account still provides operating-system attributes such as:

• UID,
• GID,
• home directory,
• login shell,
• file ownership,
• process ownership.

This configuration does not join Debian to Microsoft Entra ID and does not automatically provision Linux accounts from Entra ID. The local account must already exist before authentication can succeed.

SSH Login Flow With Microsoft Entra ID Credentials and Rublon MFA Diagram

What This Configuration Changes

The procedure replaces the primary authentication entry in:

/etc/pam.d/sshd

It does not modify the global PAM authentication file: 

/etc/pam.d/common-auth

As a result, the integration applies specifically to SSH password authentication and does not automatically change authentication for:

• sudo,
• su,
• local TTY logins,
• other applications that include common-auth.

This service-specific approach reduces the risk of unintentionally changing authentication across the entire Debian system.

Before You Start

You need:

• a server running Debian 13,
• OpenSSH Server with PAM and password authentication enabled,
• an existing Linux account resolvable through NSS for every Entra ID user who needs SSH access,
• a deployed Rublon Authentication Proxy,
• an LDAP Proxy configured in Rublon Authentication Proxy,
• Microsoft Entra ID configured as an ENTRA authentication source,
• an Entra ID application registration for Rublon Authentication Proxy,
• network connectivity between Debian and the LDAP Proxy,
• a trusted certificate for the LDAPS endpoint,
• an enabled Rublon MFA method that matches the auth_method setting in Rublon Authentication Proxy, such as Mobile Push configured with auth_method: push, 
• ensure that the method configured in auth_method is allowed for the Rublon Authentication Proxy application in the Rublon Admin Console and that the user has enrolled the required authenticator,
• console access or a separate working administrative SSH session.

Configuring Microsoft Entra ID as an authentication source for Rublon Authentication Proxy requires an Entra app registration, tenant and client identifiers, a client secret, and the appropriate Conditional Access configuration. The Rublon Authentication Proxy application must be excluded from Microsoft Entra MFA requirements so that Rublon MFA can perform the secondary authentication step.

Configure the LDAP Proxy in Rublon Authentication Proxy 

Configure an LDAP Proxy that uses the Microsoft Entra ID authentication source.

The relevant Rublon Authentication Proxy configuration includes:

• an LDAP proxy server,
• an ENTRA authentication source,
• the Microsoft Entra tenant ID,
• the application client ID,
• the application client secret,
• the virtual LDAP base DN,
• an authentication method compatible with the Entra ID UPN,
• an SSL/TLS certificate and its private key for LDAPS.

The PAM helper used in this guide performs a direct bind as the actual user:

alice@example.com

It does not first bind with a technical service account or search for the user in the virtual LDAP directory. Therefore, an LDAP access_user is not required for this particular flow.

An access_user remains an optional Rublon Authentication Proxy setting for integrations that need a persistent technical bind without MFA.

Use LDAPS for the Connection From Debian

The user’s Microsoft Entra ID password is passed from PAM to the helper and then used for the bind to Rublon Authentication Proxy. Use LDAPS to protect this communication.

The example below assumes:

Protocol: LDAPS
Port: 636
Rublon Authentication Proxy host: rap.example.com
CA certificate: /etc/ssl/certs/rap-internal-ca.pem

The Debian host must trust the certificate presented by Rublon Authentication Proxy. The proxy configuration uses cert_path and pkey_path to identify the certificate and private key it presents to LDAP clients.

Install the Required Packages

1. Update the package index and install the Python LDAP library and PAM testing utility:

apt update

apt install -y \
  python3-ldap3 \
  pamtester

2. Confirm that OpenSSH Server is running:

systemctl status ssh --no-pager

Create or Verify the Linux Account

1. Check whether the local account already exists:

id alice

2. Review its entry in the system user database: 

getent passwd alice

3. Confirm that its home directory exists:

ls -ld /home/alice

4. If the account does not exist, create it:

adduser alice

The local username does not have to contain the Entra ID domain. In this example, the user enters:

alice

The PAM helper maps it to:

alice@example.com

The helper should reject authentication when the local account does not exist. This prevents successful Entra ID authentication from starting a session for a user that Debian cannot represent locally.

Prepare an Example PAM Mapping Script

PAM does not natively perform the required mapping from a local username to an Entra ID UPN and then bind to Rublon Authentication Proxy.

You must create a small helper program that:

1. receives the username from PAM,
2. confirms that the local Linux account exists,
3. reads the password supplied by PAM,
4. maps the local username to an Entra ID UPN,
5. establishes a verified LDAPS connection to Rublon Authentication Proxy,
6. performs a bind as the Entra ID user,
7. waits for the Rublon MFA result,
8. returns success or failure to PAM.

Create the following file:

/usr/local/sbin/pam-rap-entra.py

Use this example as a starting point:

#!/usr/bin/env python3

import os
import pwd
import ssl
import sys
import syslog

from ldap3 import (
    AUTO_BIND_NO_TLS,
    SIMPLE,
    Connection,
    Server,
    Tls,
)
from ldap3.core.exceptions import LDAPException


# Replace these values with settings for your environment.
RAP_HOST = "rap.example.com"
RAP_PORT = 636
RAP_CA_CERT = "/etc/ssl/certs/rap-internal-ca.pem"
UPN_SUFFIX = "example.com"

CONNECT_TIMEOUT = 10
AUTH_TIMEOUT = 90
MAX_PASSWORD_BYTES = 512


def log_error(message: str) -> None:
    syslog.openlog("pam-rap-entra")
    syslog.syslog(
        syslog.LOG_AUTHPRIV | syslog.LOG_ERR,
        message,
    )
    syslog.closelog()


def log_info(message: str) -> None:
    syslog.openlog("pam-rap-entra")
    syslog.syslog(
        syslog.LOG_AUTHPRIV | syslog.LOG_INFO,
        message,
    )
    syslog.closelog()


def main() -> int:
    pam_user = os.environ.get("PAM_USER", "").strip()
    pam_service = os.environ.get("PAM_SERVICE", "unknown").strip()

    if not pam_user:
        log_error("PAM_USER is empty")
        return 1

    # Debian needs a Linux account resolvable through NSS to provide
    # the UID, GID, home directory, shell, file ownership,
    # and process ownership.
    try:
        pwd.getpwnam(pam_user)
    except KeyError:
        log_error(
            f"Local Linux user does not exist: {pam_user}"
        )
        return 1

    # pam_exec.so with expose_authtok passes the authentication
    # token to the command through standard input.
    raw_password = sys.stdin.buffer.read(MAX_PASSWORD_BYTES)

    try:
        password = raw_password.rstrip(
            b"\x00\r\n"
        ).decode(
            "utf-8",
            errors="strict",
        )
    except UnicodeDecodeError:
        log_error(
            f"Password decoding failed for user: {pam_user}"
        )
        return 1

    if not password:
        log_error(
            f"Empty password received for user: {pam_user}"
        )
        return 1

    # Map the Linux username to the Microsoft Entra ID UPN.
    if "@" in pam_user:
        log_error(
            f"Full UPN is not accepted as the Linux username: {pam_user}"
        )
        return 1

    entra_upn = f"{pam_user}@{UPN_SUFFIX}"


    tls_config = Tls(
        validate=ssl.CERT_REQUIRED,
        ca_certs_file=RAP_CA_CERT,
    )

    server = Server(
        RAP_HOST,
        port=RAP_PORT,
        use_ssl=True,
        tls=tls_config,
        connect_timeout=CONNECT_TIMEOUT,
    )

    connection = None

    try:
        connection = Connection(
            server,
            user=entra_upn,
            password=password,
            authentication=SIMPLE,
            auto_bind=AUTO_BIND_NO_TLS,
            receive_timeout=AUTH_TIMEOUT,
            raise_exceptions=True,
        )

        log_info(
            "Authentication successful: "
            f"service={pam_service}, "
            f"local={pam_user}, "
            f"entra={entra_upn}"
        )
        return 0

    except LDAPException as exc:
        log_error(
            "Authentication failed: "
            f"service={pam_service}, "
            f"local={pam_user}, "
            f"entra={entra_upn}, "
            f"error={exc}"
        )
        return 1

    except Exception as exc:
        log_error(
            "Unexpected authentication error: "
            f"service={pam_service}, "
            f"local={pam_user}, "
            f"entra={entra_upn}, "
            f"error={exc}"
        )
        return 1

    finally:
        if connection is not None:
            try:
                connection.unbind()
            except Exception:
                pass


if __name__ == "__main__":
    sys.exit(main())

The pam_exec module exposes PAM environment variables such as PAM_USER and can pass the authentication token to the invoked program through standard input when expose_authtok is used.

Adapt the Example Script

1. Before testing it, replace:

RAP_HOST = "rap.example.com"

with the DNS hostname included in the Subject Alternative Name (SAN) of the certificate presented by the Rublon Authentication Proxy LDAPS endpoint. The hostname must resolve to the Rublon Authentication Proxy server.

Do not use an IP address unless the certificate contains that IP address as an IP Subject Alternative Name.

2. Set:

UPN_SUFFIX = "example.com"

to the verified domain used in the users’ Microsoft Entra ID UPNs.

3. Set:

RAP_CA_CERT = "/etc/ssl/certs/rap-internal-ca.pem"

to the certificate authority file that Debian should use to validate the LDAPS certificate presented by Rublon Authentication Proxy.

Do not hardcode the Microsoft Entra application client secret in this script. That credential belongs in the secured Rublon Authentication Proxy configuration or its configured secret source.

The script receives the user’s password through standard input. It does not write the password to a file or include it in the system logs.

Secure the Script

1. Set the owner and permissions:

chown root:root /usr/local/sbin/pam-rap-entra.py
chmod 0700 /usr/local/sbin/pam-rap-entra.py

2. Validate the Python syntax:

python3 -m py_compile /usr/local/sbin/pam-rap-entra.py

No output indicates that the syntax check completed successfully. 

Test the PAM Helper Before Modifying SSH

Do not connect the script to the SSH authentication stack before testing it independently.

1. Create a dedicated PAM test service:

cat > /etc/pam.d/rap-entra-test <<'EOF'
#%PAM-1.0
auth required pam_exec.so expose_authtok quiet /usr/local/sbin/pam-rap-entra.py
account required pam_permit.so
EOF

2. Run the test as root:

pamtester rap-entra-test alice authenticate

3. When prompted for a password, enter the password for alice@example.com.

4. Complete the Rublon MFA authentication. The expected result is:

pamtester: successfully authenticated 

5. Do not continue until this isolated test succeeds. It confirms that:

• PAM can start the script,
• the Linux account can be resolved through NSS,
• username mapping works,
• Debian trusts the Rublon Authentication Proxy certificate,
• the LDAPS connection works,
• Entra ID accepts the password,
• Rublon MFA completes successfully.

Verify the Effective OpenSSH Configuration

Check the effective OpenSSH settings instead of relying only on entries visible in /etc/ssh/sshd_config:

sshd -T | grep -E \
sshd -T | grep -E \
'^(usepam|passwordauthentication|pubkeyauthentication|kbdinteractiveauthentication|authenticationmethods|permitrootlogin|logingracetime) '

If the OpenSSH configuration contains Match directives, also verify the effective configuration for the actual user and client address:

sshd -T \
-C user=alice,host=debian-server,addr=192.0.2.20 \
| grep -E \
'^(usepam|passwordauthentication|pubkeyauthentication|kbdinteractiveauthentication|authenticationmethods) '

Replace debian-server with the SSH server hostname and 192.0.2.20 with the client IP address.

The -C option evaluates matching OpenSSH configuration conditions for the specified connection. This helps detect settings applied through Match User, Match Group, Match Address, or similar directives.

For the configuration described in this guide, the relevant output should indicate:

usepam yes
passwordauthentication yes
pubkeyauthentication yes
kbdinteractiveauthentication no
authenticationmethods any
permitrootlogin prohibit-password

When UsePAM is enabled, OpenSSH uses PAM for password authentication as well as PAM account and session processing. The default PAM service name is sshd, which means OpenSSH uses /etc/pam.d/sshd. Debian also loads configuration fragments from /etc/ssh/sshd_config.d/, so checking the effective configuration helps identify settings that override the main file. PermitRootLogin must not be set to yes. Use prohibit-password when root public key access must remain available, or no when direct root SSH access is not required. Administrative users should sign in with their individual Linux accounts and use the organization’s approved privilege elevation mechanism.

If you must change the OpenSSH configuration, validate it before restarting the service:

sshd -t

Do not restart SSH unless the validation succeeds.

Connect the PAM Helper to SSH

Do not close your current administrative session. Keep a working SSH connection open or ensure that you can access the server through its physical or virtual console. An incorrect PAM configuration can prevent new password-based SSH sessions from opening.

1. Create a backup:

cp -a \
  /etc/pam.d/sshd \
  "/root/sshd-pam.before-entra-$(date +%F-%H%M%S)"

2. Open:

/etc/pam.d/sshd

Locate the line:

@include common-auth

Replace it with:

auth required pam_exec.so expose_authtok quiet /usr/local/sbin/pam-rap-entra.py

3. The beginning of the file should now resemble:

# PAM configuration for the Secure Shell service

# Authenticate SSH password logins through
# Microsoft Entra ID and Rublon MFA.
auth required pam_exec.so expose_authtok quiet /usr/local/sbin/pam-rap-entra.py

account required pam_nologin.so
@include common-account

Leave the existing account, session, and other service-specific entries unchanged.

Review the file:

nl -ba /etc/pam.d/sshd | head -n 20

A restart of the OpenSSH service is normally unnecessary when only /etc/pam.d/sshd has changed. PAM reads the service configuration for subsequent authentication attempts.

Test the SSH PAM Service

Test the actual sshd PAM stack before starting a remote login:

pamtester sshd alice authenticate acct_mgmt

Enter the Microsoft Entra ID password and complete Rublon MFA. Both the authentication and account management operations must complete successfully.

The expected result is:

pamtester: successfully authenticated

Test a Real SSH Password Login

Open a second terminal. Do not reuse or close the administrative session that you kept open for recovery.

Force the SSH client to use password authentication and prevent it from automatically selecting a public key:

ssh \
  -o PubkeyAuthentication=no \
  -o PreferredAuthentications=password \
  -o NumberOfPasswordPrompts=1 \
  alice@192.0.2.10

The login should proceed as follows:

1. The SSH client prompts for the password.
2. The user enters the password associated with the mapped Microsoft Entra ID account.
3. Rublon MFA initiates the additional authentication step.
4. The user completes the Rublon MFA authentication method configured in auth_method.
5. OpenSSH grants access and starts the session as the local Linux user.

After logging in, confirm the local Linux identity:

whoami

Expected result:

alice

You authenticated with the password associated with alice@example.com, but Debian created the session for the local account alice.

The SSH client supports several independent authentication methods, including password and public key authentication. PreferredAuthentications controls which methods the client attempts and in what order.

What Happens to SSH Public Key Authentication?

This procedure does not disable or modify:

PubkeyAuthentication yes

Therefore, two independent SSH login paths remain available.

Password-Based SSH Login

1. The user starts an SSH password login.
2. OpenSSH sends the authentication request through PAM.
3. PAM starts the example mapping script.
4. The script sends the mapped Entra ID UPN and password to Rublon Authentication Proxy.
5. Microsoft Entra ID verifies the primary credentials.
6. Rublon MFA requires additional authentication.
7. OpenSSH grants access after the complete flow succeeds.

Public Key Login

1. The user starts an SSH public key login.
2. OpenSSH validates the public key.
3. Access is granted if the key and the remaining OpenSSH checks are valid.
4. The password authentication flow is not invoked.
5. Microsoft Entra ID and Rublon MFA do not participate in this login.

Public key authentication can provide an independent administrative access path if Rublon Authentication Proxy, Microsoft Entra ID, or Rublon MFA is temporarily unavailable. However, this also means that public key logins are not protected by Rublon MFA in the configuration described in this guide.

Authentication Behavior After Configuration 

Access method	Username entered	Primary authentication	Additional authentication
SSH password login	Local Linux username	Microsoft Entra ID password	Rublon MFA
SSH public key login	Local Linux username	SSH public key	None in this configuration
sudo	Local Linux username	Existing local PAM configuration	Unchanged
su	Local Linux username	Existing local PAM configuration	Unchanged
Local TTY login	Local Linux username	Existing local PAM configuration	Unchanged

Logs and Troubleshooting

View PAM Helper Logs

Display all entries generated by the example script:

journalctl -t pam-rap-entra

Follow them in real time:

journalctl -f -t pam-rap-entra

View OpenSSH Logs

Follow the SSH service log:

journalctl -u ssh -f

Test the LDAPS Port

Verify that the Debian host can connect to Rublon Authentication Proxy:

nc -vz rap.example.com 636

Test the LDAPS Certificate

Inspect the certificate and verify it against the configured CA:

openssl s_client \
  -connect rap.example.com:636 \
  -servername rap.example.com \
  -CAfile /etc/ssl/certs/rap-internal-ca.pem \
  </dev/null

Look for:

Verify return code: 0 (ok)

Repeat the PAM Tests

Test the isolated helper:

pamtester rap-entra-test alice authenticate

Test the SSH PAM stack:

pamtester sshd alice authenticate acct_mgmt

Common Problems

The Linux user cannot be resolved through NSS

Check:

getent passwd alice
id alice

The helper intentionally rejects users who do not have a local account.

Rublon MFA does not start

Confirm that:

• the LDAP Proxy uses the correct Entra authentication source,
• the bind username is mapped to the correct Entra ID UPN,
• the user exists in Microsoft Entra ID,
• the Entra application and Conditional Access exclusion are configured correctly,
• the Rublon integration and policy allow authentication.

Certificate validation fails

Confirm that:

• the hostname in RAP_HOST matches the certificate,
• the CA certificate path is correct,
• the certificate has not expired,
• the complete certificate chain is available,
• the LDAP Proxy presents the expected certificate.

Public key authentication is selected instead of password authentication

Use the test command with:

-o PubkeyAuthentication=no
-o PreferredAuthentications=password

This prevents a locally available key from hiding problems in the password authentication path.

Restore the Previous SSH PAM Configuration

List the available backups:

ls -1t /root/sshd-pam.before-entra-* | head

Restore the selected backup:

cp -a \
  /root/sshd-pam.before-entra-YYYY-MM-DD-HHMMSS \
  /etc/pam.d/sshd

Test the restored PAM service:

pamtester sshd alice authenticate

Keep the existing administrative session open until you have confirmed that a new SSH session can be established.

Availability and Failure Behavior

Password-based SSH access depends on the following components:

1. Debian and OpenSSH must be operational.
2. PAM must be able to start the example mapping script.
3. The script must be able to resolve and connect to Rublon Authentication Proxy.
4. The LDAPS certificate must pass validation.
5. Rublon Authentication Proxy must be available.
6. Microsoft Entra ID must accept the primary credentials.
7. The Rublon MFA authentication must complete successfully.
8. PAM account and session processing must allow the login.

If any required component fails, SSH password authentication fails closed.

Possible causes include:

• network connectivity failures,
• DNS resolution failures,
• an unavailable Rublon Authentication Proxy server,
• an expired or untrusted LDAPS certificate,
• unavailable Microsoft Entra ID services,
• invalid Microsoft Entra ID credentials,
• unavailable Rublon services,
• an expired authentication timeout,
• an error in the example PAM helper,
• an invalid PAM configuration.

SSH public key authentication remains available only because it is configured as a separate OpenSSH authentication method. Organizations should determine whether retaining this independent path is appropriate for their security, compliance, and recovery requirements.

Security Considerations

Before deploying this configuration in production:

• use LDAPS and validate the Rublon Authentication Proxy certificate,
• restrict access to the LDAP Proxy with firewall rules,
• keep the PAM helper owned by root,
• do not include passwords or Entra client secrets in the script,
• retain a tested recovery access path,
• test PAM changes before applying them to SSH,
• avoid modifying common-auth unless all affected services have been reviewed,
• monitor authentication failures and connection timeouts,
• document how local Linux accounts map to Entra ID UPNs,
• define a process for creating, disabling, and removing local accounts.

The helper script should be treated as environment-specific integration code. Administrators are responsible for reviewing and maintaining it alongside changes to Debian, Python, the ldap3 package, PAM, OpenSSH, certificates, and the Rublon Authentication Proxy configuration.

Summary

Rublon Authentication Proxy can enable SSH password authentication with Microsoft Entra ID credentials on Debian 13, even though Microsoft Entra ID is not a native SSH or traditional LDAP authentication service.

A service-specific PAM helper:

1. receives the local Linux username,
2. confirms that the Linux account can be resolved through NSS,
3. maps the username to an Entra ID UPN,
4. sends the password to Rublon Authentication Proxy over LDAPS,
5. waits for Microsoft Entra ID verification and Rublon MFA,
6. returns the authentication result to PAM.

The resulting session still runs as the local Linux account. Only SSH password authentication is changed. Public key authentication and services that continue to use common-auth remain independent.

FAQ: SSH Authentication With Microsoft Entra ID and Rublon MFA

Learn More

• Authenticate LDAP and RADIUS With Microsoft Entra ID Credentials and MFA
• Enable XRDP and GNOME Logins Using Microsoft Entra ID Credentials and MFA
• Rublon Authentication Proxy documentation
• How to Set Up LDAPS Certificates in Rublon Authentication Proxy