Losing my mind, Cant seem to get QR code to appear via SSH

[lynxus]

Hi Guys,

Im almost got this working by following the guide on the wiki, however i NEVER get a QR code displayed on login.
What could be wrong?

Ubuntu 24.04 , Fully patched. Any thoughts?

`PS C:\Users\xxx> ssh xxx@sxxxx@xxxxxxx
(xxx@sxxxx@xxxxxxx) == Broker selection ==
1 - local
2 - Microsoft Entra ID
Select broker: 2
Scan the QR code or access "https://microsoft.com/devicelogin" and use the provided login code
https://microsoft.com/devicelogin
SOMECODE

(xxx@sxxxx@xxxxxxx) == Qr Code authentication (use 'r' to go back) ==
1 - Wait for the QR code scan result
2 - Request new login code
Select action:`

[lynxus]

I also seem to end up in a weird loop where auth works and it then asks me to enter a local password.
I do that, and it disconnects me.

I login again, it asks for the password and just fails.

[3v1n0]

I feel we'd need further logging for that.

See https://github.com/ubuntu/authd/wiki/06--Troubleshooting-reference

[jbrucato-eci]

Running into the same issue here (also Ubuntu 24.04 fully patched). Auth seems to function when code is submitted, but I drop down into a local password loop:

_>>ssh username@[email protected]
(username@[email protected]) == Broker selection ==
1 - local
2 - Microsoft Entra ID
Select broker: 2
Insert 'r' to cancel the request and go back
(username@[email protected]) Enter your local password:
(username@[email protected]) == Authentication mode selection (use 'r' to go back) ==
1 - Local Password Authentication
2 - Device Authentication
Select authentication mode: 2
Scan the QR code or access "https://microsoft.com/devicelogin" and use the provided login code
https://microsoft.com/devicelogin
AQCEFPFAE

(username@[email protected]) == Qr Code authentication (use 'r' to go back) ==
1 - Wait for the QR code scan result
2 - Request new login code
Select action: 1
Insert 'r' to cancel the request and go back
(username@[email protected]) Create a local password:_

Periodically seeing the following in Authd logs:

Nov 12 18:02:06 MYSERVER systemd[1]: Stopping authd.service - Authd daemon service...
Nov 12 18:02:06 MYSERVER systemd[1]: authd.service: Deactivated successfully.
Nov 12 18:02:06 MYSERVER systemd[1]: Stopped authd.service - Authd daemon service.
Nov 12 18:02:06 MYSERVER systemd[1]: Starting authd.service - Authd daemon service...
Nov 12 18:02:06 MYSERVER systemd[1]: Started authd.service - Authd daemon service.
Nov 12 18:05:11 MYSERVER authd[3654]: 2024/11/12 18:05:11 WARN rpc error: code = NotFound desc =
Nov 12 18:10:11 MYSERVER authd[3654]: 2024/11/12 18:10:11 WARN rpc error: code = NotFound desc =
lines 48-79/79 (END)

Auth logs during attempt:
2024-11-12T18:16:26.427587+00:00 MYSERVER sshd[3891]: pam_aad(sshd:account): AadAuthorize, Version: 1.0.028680001; CorrelationId: XXXXXXX
2024-11-12T18:16:26.427804+00:00 MYSERVER sshd[3891]: pam_aad(sshd:account): This is an Azure machine
2024-11-12T18:16:26.578334+00:00 MYSERVER sshd[3891]: pam_aad(sshd:account): Login denied for user [email protected].
2024-11-12T18:16:26.578795+00:00 MYSERVER sshd[3888]: error: PAM: User account has expired for [email protected] from x.x.x.x
2024-11-12T18:16:26.640504+00:00 MYSERVER sshd[3888]: fatal: monitor_read: unpermitted request 104

[lynxus]

I also get this
Login denied for user NAME
error: PAM: User account has expired for NAME from 77.xx.xx.xx

Yet, the user never gets created and isnt expired. What one earth is wrong with this module.

[3v1n0]

error: PAM: User account has expired for NAME from 77.xx.xx.xx

This is not coming from authd module, but from some other module you have in your PAM stack (check common-auth or common-account).

[3v1n0]

So, rendering QrCode in SSH can't be really done in a reliable way, so we're just not showing it as per #497 and #500.

We indeed have to change the text in the broker for such case and we're working on it.

We'll also try to use #-based (so ASCII) rendered qrcode going forward but that's coming next.

For now you've sadly to type the URI (but being always the same and not hard to type I guess it's not an issue) and there you can add the code.