pgina VS adsys

Along with pGina - http://pgina.org/

In addition to the usual protection advice (disable upnp etc) I have the main admin account setup with 2FA using google authenticator. Staff work stations are connected via LDAP Windows Auth (pGina - http://pgina.org/) and have access to their own home folder and limited shared folders depending on their requirements (so no single account has access to everything. Remote Access is done via OpenVPN that passes though a wireguard firewall. I also have my own DNS setup for the entire office running (Adguard Home - https://github.com/AdguardTeam/AdGuardHome). I'm running local backups (once weekly) and snapshops running hourly for 48 hours, daily for 14 days, weekly for 8 weeks and monthly for 4 months. I also have a third backup weekly setup to a 3rd party service (backblaze - https://www.backblaze.com/business-pricing.html)

You can use pGina to auth windows users via LDAP without samba/active directory.

For the record, though, Windows can authenticate against FreeIPA. Back when NIS was still viable, we used NISGINA; the modern incarnation is pGINA. We contemplated authenticating our Linux machines with RADIUS while using LDAP for the directory, but put it on the back-burner and I'd forgotten about it.

Setup whatever Linux LDAP/Kerberos solution you want to try and see if you can get pGina to work for your Windows clients.

I've found an old post about it here and somebody mentions this open source authentication app that seems to let you do desktop auth with RADIUS but doesn't seem to be developed anymore.

We used to replace the GINA in NT so it would authenticate to NIS. The modern equivalent of NISgina is pGina

Only suggestions I have would be to check the docs here: https://github.com/ubuntu/adsys/wiki/04.-Using-GPO

Ubuntu 21.04 hirsute includes adsys which is a linux active directory client.

Check out this: https://github.com/ubuntu/adsys/tree/main/internal/policies/ad/definitions/policy/Ubuntu/all

Looking at https://github.com/ubuntu/adsys (linked below by /u/SadFaceSmith it looks like they are providing an ADMX template for Ubuntu that you configure along side your windows GPO stuff. They aren't trying to parse the existing windows focused GPO stuff at all.

I am also trying to figure it out now. While creating the local user at installation there is a checkbox to join a domain, followed by some light configuration. I did that and the device is now showing up on my domain controller, but I am not able to log into the Ubuntu device with domain user accounts. The release notes say that there is a command adsysctl included by default, but I found I needed to install adsys myself, but I didn't get much further with it. I also saw that I was able to add domain accounts with the Users GUI once signed in with the local account, but I was not able to sign in with the account even after adding it here.