NAME¶
pam_duo
—
PAM module for Duo authentication
SYNOPSIS¶
pam_duo.so
[
conf=
⟨FILENAME⟩
]
DESCRIPTION¶
pam_duo
provides secondary authentication
(typically after successful password-based authentication) through the Duo
authentication service.
OPTIONS¶
PAM module configuration options supported:
- conf
- Specify an alternate configuration file to load. Default is
/etc/duo/pam_duo.conf
- debug
- Debug mode; send log messages to stderr instead of syslog.
CONFIGURATION¶
The INI-format configuration file must have a
“
duo
” section with the following
options:
host
- Duo API host (required).
ikey
- Duo integration key (required).
skey
- Duo secret key (required).
groups
- If specified, Duo authentication is required only for users whose primary
group or supplementary group list matches one of the space-separated
pattern-lists (see
PATTERNS below).
failmode
- On service or configuration errors that prevent Duo authentication, fail
“
safe
” (allow access) or
“secure
” (deny access). Default is
“safe
”.
pushinfo
- Send command to be approved via Duo Push authentication. Default is
“
no
”.
http_proxy
- Use the specified HTTP proxy, same format as the HTTP_PROXY environment
variable.
autopush
- Automatically send a login request to the first factor (usually push),
instead of prompting the user. Default is "no".
prompts
- Set the maxiumum number of prompts pam_duo will show before denying
access. Default is 3.
fallback_local_ip
- If unable to detect the authorizing user's IP address, fallback on the
server's IP. Default is "no".
An example configuration file:
[duo]
host = api-deadbeef.duosecurity.com
ikey = SI9F...53RI
skey = 4MjR...Q2NmRiM2Q1Y
pushinfo = yes
autopush = yes
Other authentication restrictions may be implemented using
pam_listfile(8),
pam_access(8), etc.
PATTERNS¶
A
pattern consists of zero or more non-whitespace
characters, ‘*’ (a wildcard that matches zero or more
characters), or ‘?’ (a wildcard that matches exactly one
character).
A
pattern-list is a comma-separated list of
patterns. Patterns within pattern-lists may be negated by preceding them with
an exclamation mark (‘!’). For example, to specify Duo
authentication for all users (except those that are also admins), and for
guests:
groups = users,!wheel,!*admin
guests
FILES¶
- /etc/duo/pam_duo.conf
- Default configuration file path
AUTHORS¶
pam_duo
was written by
Duo Security
⟨support@duosecurity.com⟩
NOTES¶
When used with OpenSSH's
sshd(8), only PAM-based
authentication can be protected with this module; pubkey authentication
bypasses PAM entirely. OpenSSH's PAM integration also does not honor an
interactive
pam_conv(3) conversation, prohibiting
real-time Duo status messages (such as during voice callback).