thelinuxvault blog

Microsoft SQL Server Active Directory Authentication on Linux Machine

In today's enterprise environments, integrating Microsoft SQL Server with Active Directory (AD) for authentication on Linux machines is a common requirement. This allows for centralized user management, enhanced security, and seamless access for users who are already part of the AD domain. In this blog, we'll explore the steps, best practices, and example usage for setting up SQL Server Active Directory authentication on a Linux machine.

2026-05

Table of Contents#

  1. Prerequisites
  2. Installing SQL Server on Linux
  3. Configuring Active Directory Authentication
    • Joining the Linux Machine to the AD Domain
    • Configuring SQL Server for AD Authentication
  4. Example Usage
  5. Best Practices
  6. Common Issues and Troubleshooting
  7. Conclusion
  8. References

1. Prerequisites#

  • Linux Machine: You need a Linux distribution (e.g., Ubuntu, Red Hat Enterprise Linux) with appropriate permissions to install software.
  • Active Directory Domain: A functioning Active Directory domain with domain controllers.
  • SQL Server Installation Media: Download the appropriate SQL Server version for Linux from the Microsoft website.

2. Installing SQL Server on Linux#

For Ubuntu#

  1. Update Package Lists:
sudo apt-get update
  1. Install SQL Server:
curl https://packages.microsoft.com/keys/microsoft.asc | sudo apt-key add -
sudo add-apt-repository "$(curl https://packages.microsoft.com/config/ubuntu/$(lsb_release -rs)/prod.list)"
sudo apt-get update
sudo apt-get install -y mssql-server
  1. Configure SQL Server:
sudo /opt/mssql/bin/mssql-conf setup

Follow the prompts to set the SA password and accept the license terms.

For Red Hat Enterprise Linux#

  1. Install SQL Server:
sudo yum install -y mssql-server
  1. Configure SQL Server:
sudo /opt/mssql/bin/mssql-conf setup

Again, set the SA password and accept the license terms.

3. Configuring Active Directory Authentication#

Joining the Linux Machine to the AD Domain#

For Ubuntu#

  1. Install Required Packages:
sudo apt-get install -y realmd sssd sssd-tools adcli samba-common-bin
  1. Join the Domain:
sudo realm join -U <domain_admin_username> <domain_name>

For example:

sudo realm join -U administrator contoso.com

Enter the domain admin password when prompted.

For Red Hat Enterprise Linux#

  1. Install Required Packages:
sudo yum install -y realmd sssd sssd-tools adcli samba-common-tools
  1. Join the Domain:
sudo realm join -U <domain_admin_username> <domain_name>

Similar to Ubuntu, enter the password when asked.

Configuring SQL Server for AD Authentication#

SQL Server on Linux does not support direct login and password settings in the [security] section of mssql.conf for Active Directory authentication. Instead, you must use the adutil tool or configure Kerberos keytab authentication.

  1. Install adutil:
sudo yum install -y mssql-adutil  # For RHEL
sudo apt-get install -y mssql-adutil  # For Ubuntu (via Microsoft repository)
  1. Configure AD authentication:
sudo adutil keytab create --realm <REALM> --principal <username>@<REALM> --password <password>
  1. Enable AD authentication in mssql.conf: Edit /var/opt/mssql/mssql.conf and add:
[network]
kerberoskeytabfile = /var/opt/mssql/krb5.keytab
 
[network.kerberos]
credkeytab = enabled
krbcanonicalize = enabled
  1. Grant keytab file permissions:
sudo chown mssql:mssql /var/opt/mssql/krb5.keytab
sudo chmod 440 /var/opt/mssql/krb5.keytab

Alternatively, you can configure Kerberos manually by setting up the keytab file and the [network.kerberos] section in mssql.conf. After configuration, restart SQL Server:

sudo systemctl restart mssql-server

4. Example Usage#

Once configured, you can connect to SQL Server using AD credentials. For example, using the sqlcmd utility:

sqlcmd -S <server_name> -U <domain_username> -P <domain_password> -d <database_name>

Replace <server_name>, <domain_username>, <domain_password>, and <database_name> with your actual values.

5. Best Practices#

  • Use Least Privilege: Grant only the necessary permissions to the AD user account used for SQL Server authentication.
  • Regularly Rotate Passwords: Follow your organization's password rotation policy for the AD accounts.
  • Test Connectivity: Periodically test the AD authentication connection to ensure it's working as expected.
  • Monitor Logs: Check the SQL Server error logs (/var/opt/mssql/log/errorlog) and the system logs (/var/log/syslog or /var/log/messages) for any authentication-related issues.

6. Common Issues and Troubleshooting#

  • Authentication Failure:
    • Verify that the keytab file is properly configured and accessible by the mssql user.
    • Check that the Kerberos configuration (krb.conf or /etc/krb5.conf) is correct for your AD domain.
    • Verify that the Linux machine is properly joined to the AD domain. You can use commands like realm list to check the domain membership.
    • Ensure that the AD user has the correct permissions in SQL Server (e.g., it's a member of the appropriate database roles).
  • SSSD Issues: If there are problems with the SSSD (System Security Services Daemon) which is involved in AD authentication, check its logs (/var/log/sssd/sssd_*.log). Common issues could be related to DNS configuration (make sure the Linux machine can resolve AD domain controllers) or incorrect SSSD configuration.

7. Conclusion#

Configuring Microsoft SQL Server Active Directory authentication on a Linux machine provides a more secure and centralized way of managing user access. By following the steps, best practices, and troubleshooting tips outlined in this blog, you can successfully set up and maintain this authentication method in your enterprise environment.

8. References#