Duo Unix - Two-Factor Authentication for SSH with PAM Support (pam

Documentation

Duo Unix - Two-Factor Authentication for SSH with PAM Support (pam_duo)

Duo can be easily added to any Unix system to protect remote (SSH) or local logins with the addition of a simple pam_duo PAM module. It has been tested on Linux (RedHat, Fedora, CentOS, Debian, Ubuntu, Amazon Linux), BSD (FreeBSD, NetBSD, OpenBSD), Solaris, HP-UX, and AIX. The code is open-source and available on GitHub.

Overview

Duo Unix with Pluggable Authentication Modules (PAM) support provides a secure and customizable method for protecting Unix and Linux logins. We recommend deploying the pam_duo module in most scenarios, but if you are unable to use PAM see our login_duo instructions.

Walkthrough Video

First Steps

Before starting:

Sign up for a Duo account.
Log in to the Duo Admin Panel and navigate to Applications.
Click Protect an Application and locate UNIX Application in the applications list. Click Protect this Application to get your integration key, secret key, and API hostname. See Getting Started for help.

Connectivity Requirements

This integration communicates with Duo's service on TCP port 443. Also, we do not recommend locking down your firewall to individual IP addresses, since these may change over time to maintain our service's high availability.

Installation

Install `pam_duo` Prerequisites

OpenSSL development headers and libraries are required for pam_duo, as well as libpam. When compiling on SUSE/SLES, the zlib package is also necessary.

Dependency	Platform	Installation
OpenSSL	FreeBSD, NetBSD	Installed by default
	Debian, Ubuntu	`apt-get install libssl-dev`
	Red Hat, Fedora, CentOS, Amazon Linux	`yum install openssl-devel`
	SUSE/SLES	`zypper install libopenssl-devel`
	Solaris	`pkg install openssl`
	HP-UX, AIX	3rd party packages or source build
libpam	FreeBSD, NetBSD, Solaris, HP-UX, AIX	Installed by default
	Debian, Ubuntu	`apt-get install libpam-dev`
	Red Hat, Fedora, CentOS, Amazon Linux	`yum install pam-devel`
	SUSE/SLES	`zypper install pam-devel`
zlib	SUSE/SLES	`zypper install zlib-devel`

You also need a compiler like gcc installed on your system to build Duo Unix.

Install `pam_duo`

Once the required dependencies are built and installed, download, build, and install duo_unix.

Download and extract the latest version of duo_unix (checksum). Change to the extracted directory (note your actual extracted directory name reflects the actual version downloaded; the example syntax below references version 1.10.0).
```
$ wget https://dl.duosecurity.com/duo_unix-latest.tar.gz
$ tar zxf duo_unix-latest.tar.gz
$ cd duo_unix-1.10.0
```
Build and install duo_unix with PAM support ( pam_duo).
```
$ ./configure --with-pam --prefix=/usr && make && sudo make install
```
For advanced build options, see the README file in the source tarball.
Once duo_unix is installed, edit /etc/duo/pam_duo.conf (in /etc/duo or /etc/security) to add the integration key, secret key, and API hostname from your Duo Unix application.
```
[duo]
; Duo integration key
ikey = INTEGRATION_KEY
; Duo secret key
skey = SECRET_KEY
; Duo API hostname
host = API_HOSTNAME
```
You may also add optional Duo configuration options to pam_duo.conf. See the table in Duo Configuration Options for all available settings.

Public Key Authentication

If you would like to use pam_duo with SSH public key authentication, make the following changes to your sshd_config file (usually in /etc or /etc/ssh).

This feature is only available with OpenSSH 6.2+, SSH protocol 2, and Duo Unix 1.9.15 or later.

PubkeyAuthentication yes
PasswordAuthentication no
AuthenticationMethods publickey,keyboard-interactive

We recommend leaving a root shell open while making any changes to your PAM configuration, in order to prevent accidentally locking yourself out. Additionally, always make sure your PAM configuration works locally before testing it with SSH logins.

PAM Configuration

You'll need to modify your system's PAM configuration to include a line like the following:

auth required pam_duo.so

Depending on your OS or architecture, the pam_duo.so module might be in /lib64/security instead of the default location /lib/security. If so, specify the full path to pam_duo.so in the PAM config file, such as /lib64/security/pam_duo.so.

The location of this line and the specified control flag (e.g. "required", "requisite", "sufficient") varies. For most common configurations, place pam_duo directly after pam_unix (frequently found in common-auth or system-auth on Linux), set pam_unix's control flag to "requisite", and set pam_duo's control flag to whatever pam_unix used to be.

If you want to use pam_duo with your installation of OpenSSH sshd, set both UsePAM and ChallengeResponseAuthentication to yes in your sshd_config file (usually in /etc or /etc/ssh). You should also set UseDNS to no so that PAM Duo is always passed the IP address of the connecting user, rather than the resolved hostname.

UsePAM yes
ChallengeResponseAuthentication yes
UseDNS no

PAM Examples

PAM configuration examples for common Linux systems:

Remember that you may need to specify the full path to pam_duo.so in the PAM config file, such as /lib64/security/pam_duo.so if the module is not in the default location /lib/security.

CentOS 5

SSH Public Key Authentication

/etc/pam.d/sshd

Before:

#%PAM-1.0
auth  include system-auth

After:

#%PAM-1.0
#auth  include system-auth
auth  required pam_env.so
auth  sufficient pam_duo.so
auth  required pam_deny.so

SELinux

If you are running SELinux you must also update your policies to include authlogin_duo (run from the location where you built Duo Unix):

sudo make -C pam_duo semodule
sudo make -C pam_duo semodule-install

This allows sshd to make outgoing HTTP connections, which is required for Duo authentication to complete.

Verify that your SELinux configuration has been updated to include Duo:

$ semodule -l | grep duo

The semodule output show include

authlogin_duo   1.0

System-wide Authentication

/etc/pam.d/system-auth

Before:

auth  required pam_env.so
auth  sufficient pam_unix.so nullok try_first_pass
auth  requisite pam_succeed_if.so uid >= 500 quiet
auth  required pam_deny.so

After:

auth  required pam_env.so
# auth  sufficient pam_unix.so nullok try_first_pass
auth  requisite pam_unix.so nullok try_first_pass
auth  sufficient pam_duo.so
auth  requisite pam_succeed_if.so uid >= 500 quiet
auth  required pam_deny.so

CentOS 6

SSH Public Key Authentication

/etc/pam.d/sshd

Before:

#%PAM-1.0
auth  required pam_sepermit.so
auth  include password-auth

After:

#%PAM-1.0
auth  required pam_sepermit.so
#auth  include password-auth
auth  required pam_env.so
auth  sufficient pam_duo.so
auth  required pam_deny.so

SELinux

If you are running SELinux you must also update your policies to include authlogin_duo (run from the location where you built Duo Unix):

sudo make -C pam_duo semodule
sudo make -C pam_duo semodule-install

This allows sshd to make outgoing HTTP connections, which is required for Duo authentication to complete.

Verify that your SELinux configuration has been updated to include Duo:

$ semodule -l | grep duo

The semodule output show include

authlogin_duo   1.0

System-wide Authentication

/etc/pam.d/system-auth

Before:

auth  required pam_env.so
auth  sufficient pam_unix.so nullok try_first_pass
auth  requisite pam_succeed_if.so uid >= 500 quiet
auth  required pam_deny.so

After:

auth  required pam_env.so
# auth  sufficient pam_unix.so nullok try_first_pass
auth  requisite pam_unix.so nullok try_first_pass
auth  sufficient pam_duo.so
auth  requisite pam_succeed_if.so uid >= 500 quiet
auth  required pam_deny.so

CentOS 7

SSH Public Key Authentication

/etc/pam.d/sshd

Before:

#%PAM-1.0
auth  required pam_sepermit.so
auth  substack password-auth
auth  include postlogin

After:

#%PAM-1.0
auth  required pam_sepermit.so
#auth  substack password-auth
auth  required pam_env.so
auth  sufficient pam_duo.so
auth  required pam_deny.so
auth  include postlogin

SELinux

If you are running SELinux you must also update your policies to include authlogin_duo (run from the location where you built Duo Unix):

sudo make -C pam_duo semodule
sudo make -C pam_duo semodule-install

This allows sshd to make outgoing HTTP connections, which is required for Duo authentication to complete.

Verify that your SELinux configuration has been updated to include Duo:

$ semodule -l | grep duo

The semodule output show include

authlogin_duo   1.0

System-wide Authentication

/etc/pam.d/system-auth

Before:

auth  required pam_env.so
auth  sufficient pam_unix.so nullok try_first_pass
auth  requisite pam_succeed_if.so uid >= 500 quiet
auth  required pam_deny.so

After:

auth  required pam_env.so
# auth  sufficient pam_unix.so nullok try_first_pass
auth  requisite pam_unix.so nullok try_first_pass
auth  sufficient pam_duo.so
auth  requisite pam_succeed_if.so uid >= 500 quiet
auth  required pam_deny.so

Ubuntu 12.04

SSH Public Key Authentication

/etc/pam.d/sshd

Before:

@include common-auth

After:

#@include common-auth
auth  [success=1 default=ignore] pam_duo.so
auth  requisite pam_deny.so
auth  required pam_permit.so

System-wide Authentication

/etc/pam.d/common-auth

Before:

auth  [success=1 default=ignore] pam_unix.so nullok_secure
auth  requisite pam_deny.so

After:

# auth  [success=1 default=ignore] pam_unix.so nullok_secure
auth  requisite pam_unix.so nullok_secure
auth  [success=1 default=ignore] pam_duo.so
auth  requisite pam_deny.so

Ubuntu 14.04

SSH Public Key Authentication

/etc/pam.d/sshd

Before:

@include common-auth

After:

#@include common-auth
auth  [success=1 default=ignore] pam_duo.so
auth  requisite pam_deny.so
auth  required pam_permit.so
auth  optional pam_cap.so

System-wide Authentication

/etc/pam.d/common-auth

Before:

auth  [success=1 default=ignore] pam_unix.so nullok_secure
auth  requisite pam_deny.so

After:

# auth  [success=1 default=ignore] pam_unix.so nullok_secure
auth  requisite pam_unix.so nullok_secure
auth  [success=1 default=ignore] pam_duo.so
auth  requisite pam_deny.so

Ubuntu 16.04

SSH Public Key Authentication

/etc/pam.d/sshd

Before:

@include common-auth

After:

#@include common-auth
auth  [success=1 default=ignore] pam_duo.so
auth  requisite pam_deny.so
auth  required pam_permit.so

System-wide Authentication

/etc/pam.d/common-auth

Before:

auth  [success=1 default=ignore] pam_unix.so nullok_secure
auth  requisite pam_deny.so
auth  required pam_permit.so

After:

# auth  [success=1 default=ignore] pam_unix.so nullok_secure
auth  requisite pam_unix.so nullok_secure
auth  [success=1 default=ignore] pam_duo.so
auth  requisite pam_deny.so
auth  required pam_permit.so

Red Hat Enterprise Linux 5

SSH Public Key Authentication

/etc/pam.d/sshd

Before:

#%PAM-1.0
auth  include system-auth

After:

#%PAM-1.0
#auth  include system-auth
auth  required pam_env.so
auth  sufficient pam_duo.so
auth  requisite pam_succeed_if.so uid >= 500 quiet
auth  required pam_deny.so

SELinux

If you are running SELinux you must also update your policies to include authlogin_duo (run from the location where you built Duo Unix):

sudo make -C pam_duo semodule
sudo make -C pam_duo semodule-install

This allows sshd to make outgoing HTTP connections, which is required for Duo authentication to complete.

Verify that your SELinux configuration has been updated to include Duo:

$ semodule -l | grep duo

The semodule output show include

authlogin_duo   1.0

System-wide Authentication

/etc/pam.d/system-auth

Before:

auth  required pam_env.so
auth  sufficient pam_unix.so nullok try_first_pass
auth  requisite pam_succeed_if.so uid >= 1000 quiet_success
auth  required pam_deny.so

After:

auth  required pam_env.so
# auth  sufficient pam_unix.so nullok try_first_pass
auth  requisite pam_unix.so nullok try_first_pass
auth  sufficient pam_duo.so
auth  requisite pam_succeed_if.so uid >= 1000 quiet_success
auth  required pam_deny.so

Red Hat Enterprise Linux 6

SSH Public Key Authentication

/etc/pam.d/sshd

Before:

#%PAM-1.0
auth  required pam_sepermit.so
auth  include password-auth

After:

#%PAM-1.0
auth  required pam_sepermit.so
#auth  include password-auth
auth  required pam_env.so
auth  sufficient pam_duo.so
auth  required pam_deny.so

SELinux

If you are running SELinux you must also update your policies to include authlogin_duo (run from the location where you built Duo Unix):

sudo make -C pam_duo semodule
sudo make -C pam_duo semodule-install

This allows sshd to make outgoing HTTP connections, which is required for Duo authentication to complete.

Verify that your SELinux configuration has been updated to include Duo:

$ semodule -l | grep duo

The semodule output show include

authlogin_duo   1.0

System-wide Authentication

/etc/pam.d/system-auth

Before:

auth  required pam_env.so
auth  sufficient pam_unix.so nullok try_first_pass
auth  requisite pam_succeed_if.so uid >= 1000 quiet_success
auth  required pam_deny.so

After:

auth  required pam_env.so
# auth  sufficient pam_unix.so nullok try_first_pass
auth  requisite pam_unix.so nullok try_first_pass
auth  sufficient pam_duo.so
auth  requisite pam_succeed_if.so uid >= 1000 quiet_success
auth  required pam_deny.so

Red Hat Enterprise Linux 7

SSH Public Key Authentication

/etc/pam.d/sshd

Before:

#%PAM-1.0
auth  required pam_sepermit.so
auth  substack password-auth
auth  include postlogin

After:

#%PAM-1.0
auth  required pam_sepermit.so
#auth  substack password-auth
auth  required pam_env.so
auth  sufficient pam_duo.so
auth  requisite pam_succeed_if.so uid >= 1000 quiet_success
auth  required pam_deny.so
auth  include postlogin

SELinux

If you are running SELinux you must also update your policies to include authlogin_duo (run from the location where you built Duo Unix):

sudo make -C pam_duo semodule
sudo make -C pam_duo semodule-install

This allows sshd to make outgoing HTTP connections, which is required for Duo authentication to complete.

Verify that your SELinux configuration has been updated to include Duo:

$ semodule -l | grep duo

The semodule output show include

authlogin_duo   1.0

System-wide Authentication

/etc/pam.d/system-auth

Before:

auth  required pam_env.so
auth  sufficient pam_unix.so nullok try_first_pass
auth  requisite pam_succeed_if.so uid >= 1000 quiet_success
auth  required pam_deny.so

After:

auth  required pam_env.so
# auth  sufficient pam_unix.so nullok try_first_pass
auth  requisite pam_unix.so nullok try_first_pass
auth  sufficient pam_duo.so
auth  requisite pam_succeed_if.so uid >= 1000 quiet_success
auth  required pam_deny.so

Debian 6

SSH Public Key Authentication

/etc/pam.d/sshd

Before:

@include common-auth

After:

#@include common-auth
auth  [success=1 default=ignore] pam_duo.so
auth  requisite pam_deny.so
auth  required pam_permit.so

System-wide Authentication

/etc/pam.d/common-auth

Before:

auth  [success=1 default=ignore] pam_unix.so nullok_secure
auth  requisite pam_deny.so
auth  required pam_permit.so

After:

#auth  [success=1 default=ignore] pam_unix.so nullok_secure
auth  [success=1 default=ignore] pam_duo.so
auth  requisite pam_deny.so
auth  required pam_permit.so

Debian 7

SSH Public Key Authentication

/etc/pam.d/sshd

Before:

@include common-auth

After:

#@include common-auth
auth  [success=1 default=ignore] pam_duo.so
auth  requisite pam_deny.so
auth  required pam_permit.so

System-wide Authentication

/etc/pam.d/common-auth

Before:

auth  [success=1 default=ignore] pam_unix.so nullok_secure
auth  requisite pam_deny.so
auth  required pam_permit.so

After:

#auth  [success=1 default=ignore] pam_unix.so nullok_secure
auth  [success=1 default=ignore] pam_duo.so
auth  requisite pam_deny.so
auth  required pam_permit.so

Debian 8

SSH Public Key Authentication

/etc/pam.d/sshd

Before:

@include common-auth

After:

#@include common-auth
auth  [success=1 default=ignore] pam_duo.so
auth  requisite pam_deny.so
auth  required pam_permit.so

System-wide Authentication

/etc/pam.d/common-auth

Before:

auth  [success=1 default=ignore] pam_unix.so nullok_secure
auth  requisite pam_deny.so
auth  required pam_permit.so

After:

#auth  [success=1 default=ignore] pam_unix.so nullok_secure
auth  [success=1 default=ignore] pam_duo.so
auth  requisite pam_deny.so
auth  required pam_permit.so

Amazon Linux

/etc/pam.d/system-auth

Before:

auth  required pam_env.so
auth  sufficient pam_unix.so nullok try_first_pass
auth  requisite pam_succeed_if.so uid >= 500 quiet
auth  required pam_deny.so

After:

auth  required pam_env.so
# auth  sufficient pam_unix.so nullok try_first_pass
auth  requisite pam_unix.so nullok try_first_pass
auth  sufficient pam_duo.so
auth  requisite pam_succeed_if.so uid >= 500 quiet
auth  required pam_deny.so

SSH Public Key Authentication

/etc/pam.d/sshd

Before:

auth  required pam_sepermit.so
auth  substack password-auth

After:

auth  required pam_sepermit.so
# auth  substack password-auth
auth  required pam_duo.so

FreeBSD

/etc/pam.d/system

Before:

# auth
auth            sufficient      pam_opie.so             no_warn no_fake_prompts
auth            requisite       pam_opieaccess.so       no_warn allow_local
# auth           sufficient      pam_krb5.so             no_warn try_first_pass
# auth           sufficient      pam_ssh.so              no_warn try_first_pass
auth            required        pam_unix.so             no_warn try_first_pass nullok

After:

# auth
auth            sufficient      pam_opie.so             no_warn no_fake_prompts
auth            requisite       pam_opieaccess.so       no_warn allow_local
# auth           sufficient      pam_krb5.so             no_warn try_first_pass
# auth           sufficient      pam_ssh.so              no_warn try_first_pass
# auth           required        pam_unix.so             no_warn try_first_pass nullok
auth            requisite       pam_unix.so             no_warn try_first_pass nullok
auth            requisite       pam_duo.so

SSH Public Key Authentication

/etc/pam.d/sshd

Before:

# auth
auth            sufficient      pam_opie.so             no_warn no_fake_prompts
auth            requisite       pam_opieaccess.so       no_warn allow_local
# auth           sufficient      pam_krb5.so             no_warn try_first_pass
# auth           sufficient      pam_ssh.so              no_warn try_first_pass
auth            required        pam_unix.so             no_warn try_first_pass

After:

# auth
auth            sufficient      pam_opie.so             no_warn no_fake_prompts
auth            requisite       pam_opieaccess.so       no_warn allow_local
# auth           sufficient      pam_krb5.so             no_warn try_first_pass
# auth           sufficient      pam_ssh.so              no_warn try_first_pass
# auth           required        pam_unix.so             no_warn try_first_pass
auth            required        pam_duo.so

AIX 7

Edit /etc/security/login.cfg and change this line near the bottom of the file:

auth_type = STD_AUTH

to read:

auth_type = PAM_AUTH

/etc/pam.conf

Before:

# Authentication
#
authexec    auth    required        pam_aix
dtaction    auth    required        pam_aix
dtsession   auth    required        pam_aix
dtlogin     auth    required        pam_aix
ftp         auth    required        pam_aix
imap        auth    required        pam_aix
login       auth    required        pam_aix
rexec       auth    required        pam_aix
rlogin      auth    sufficient      pam_rhosts_auth
rlogin      auth    required        pam_aix
rsh         auth    required        pam_rhosts_auth
snapp       auth    required        pam_aix
su          auth    required        pam_aix
swrole      auth    required        pam_aix
telnet      auth    required        pam_aix
xdm         auth    required        pam_aix
sshd        auth    required        pam_aix
OTHER       auth    required        pam_prohibit

After (protecting both su and ssh with Duo):

# Authentication
#
authexec    auth    required        pam_aix
dtaction    auth    required        pam_aix
dtsession   auth    required        pam_aix
dtlogin     auth    required        pam_aix
ftp         auth    required        pam_aix
imap        auth    required        pam_aix
login       auth    required        pam_aix
rexec       auth    required        pam_aix
rlogin      auth    sufficient      pam_rhosts_auth
rlogin      auth    required        pam_aix
rsh         auth    required        pam_rhosts_auth
snapp       auth    required        pam_aix
su          auth    requisite       pam_aix
su          auth    sufficient      /usr/lib/security/pam_duo.so
swrole      auth    required        pam_aix
telnet      auth    required        pam_aix
xdm         auth    required        pam_aix
sshd        auth    requisite       pam_aix
sshd        auth    sufficient      /usr/lib/security/pam_duo.so
OTHER       auth    required        pam_prohibit

If sshd entries do not already exist in /etc/pam.conf then add them after all the other sections:

sshd    account     required    pam_aix
sshd    password    required    pam_aix
sshd    session     required    pam_aix

Test `pam_duo`

SSH into your newly configured system. If everything is set up correctly, you'll be given an enrollment link:

Duo Unix Enrollment Prompt

Copy the enrollment link and paste it into a web browser to complete Duo's enrollment process. After enrolling your authentication device with Duo you'll receive the prompt for additional verification the next time you ssh into your system.

Duo Unix Authentication Prompt

Choose your authentication method and approve the request using your phone or other device.

Linux Distribution Packages

To more easily install and maintain Duo Unix deployments, we've built Linux packages for a variety of popular distributions. These packages are tested against the specific listed versions of their respective distributions. Please test all packages thoroughly prior to deploying them into your environment to ensure a great experience.

CentOS

Tested against 5.11 32/64-bit, 6.7 32/64-bit, and 7.1 64-bit

Create /etc/yum.repos.d/duosecurity.repo with the following contents:

[duosecurity]
name=Duo Security Repository
baseurl=http://pkg.duosecurity.com/CentOS/$releasever/$basearch
enabled=1
gpgcheck=1

Execute the following shell commands:

# rpm --import https://duo.com/RPM-GPG-KEY-DUO
# yum install duo_unix

Ubuntu

Tested against 12.04.5 32/64-bit, 14.04.3 32/64-bit, and 16.04 32/64-bit

Create /etc/apt/sources.list.d/duosecurity.list with the following contents:

deb http://pkg.duosecurity.com/Ubuntu precise main

deb http://pkg.duosecurity.com/Ubuntu trusty main

deb http://pkg.duosecurity.com/Ubuntu xenial main

Execute the following shell commands:

# curl -s https://duo.com/APT-GPG-KEY-DUO | sudo apt-key add -
# apt-get update && apt-get install duo-unix

Red Hat Enterprise Linux

Tested against 5.10 32/64-bit, 6.4 32/64-bit, and 7.0 64-bit

Create /etc/yum.repos.d/duosecurity.repo with the following contents:

[duosecurity]
name=Duo Security Repository
baseurl=http://pkg.duosecurity.com/RedHat/$releasever/$basearch
enabled=1
gpgcheck=1

Execute the following shell commands:

# rpm --import https://duo.com/RPM-GPG-KEY-DUO
# yum install duo_unix

Debian

Tested against 6.0.10 32/64-bit, 7.9 32/64-bit, and 8.2 32/64-bit

Create /etc/apt/sources.list.d/duosecurity.list with the following contents:

deb http://pkg.duosecurity.com/Debian squeeze main

deb http://pkg.duosecurity.com/Debian wheezy main

deb http://pkg.duosecurity.com/Debian jessie main

Execute the following shell commands:

# curl -s https://duo.com/APT-GPG-KEY-DUO | sudo apt-key add -
# apt-get update && apt-get install duo-unix

Troubleshooting

Need some help? Take a look at the Duo UNIX Frequently Asked Questions (FAQ) page or try searching our Duo UNIX Knowledge Base articles or Community discussions. For further assistance, contact Support.

Duo Configuration Options

The pam_duo.conf configuration files use the INI format. It can take the following options:

Key	Required?	Description
`ikey`	Required	Your integration key
`skey`	Required	Your secret key
`host`	Required	Your API hostname i.e. `api-XXXXXXXX.duosecurity.com`
`groups`	Optional	If specified, Duo authentication is required only for users whose primary group or supplementary group list matches one of the space-separated pattern lists. A pattern consists of zero or more non-whitespace characters, "``" (a wild card that matches zero or more characters), or "`?`" (a wildcard that matches exactly one character). A pattern-list is a comma-separated list of patterns. Patterns within pattern-lists may be negated by preceding them with an exclamation mark ("`!`"). For example, to specify Duo authentication for all users (except those that are also admins), and for guests: `groups = users,!wheel,!admin guests`
`failmode`	Optional	On service or configuration errors that prevent Duo authentication, fail "safe" (allow access) or "secure" (deny access). The default is "safe".
`pushinfo`	Optional	Include information such as the command to be executed in the Duo Push message. Either "yes" or "no". The default is "no".
`http_proxy`	Optional	Use the specified HTTP proxy. If the HTTP proxy requires authentication, include the credentials in the proxy URL. Example format: `http_proxy=http://username:password@proxy.example.org:8080`
`autopush`	Optional	Either "yes" or "no". Default is "no". If "yes", Duo Unix will automatically send a push login request to the user's phone, falling back on a phone call if push is unavailable. If "no", the user will be prompted to choose an authentication method. When configured with `autopush = yes`, we recommend setting `prompts = 1`.
`motd`	Optional	Print the contents of `/etc/motd` to screen after a successful login. Either "yes" or "no". The default is "no". This option is only available for `login_duo`.
`prompts`	Optional	If a user fails to authenticate with a second factor, Duo Unix will prompt the user to authenticate again. This option sets the maximum number of prompts that Duo Unix will display before denying access. Must be 1, 2, or 3. Default is 3. For example, when `prompts = 1`, the user will have to successfully authenticate on the first prompt, whereas if `prompts = 2`, if the user enters incorrect information at the initial prompt, he/she will be prompted to authenticate again. When configured with `autopush = yes`, we recommend setting `prompts = 1`.
`accept_env_factor`	Optional	Look for factor selection or passcode in the `$DUO_PASSCODE` environment variable before prompting the user for input. When `$DUO_PASSCODE` is non-empty, it will override autopush. The SSH client will need `SendEnv DUO_PASSCODE` in its configuration, and the SSH server will similarily need `AcceptEnv DUO_PASSCODE`. Default is `"no"`. This option is only available for `login_duo`.
`fallback_local_ip`	Optional	Duo Unix reports the IP address of the authorizing user, for the purposes of authorization and whitelisting. If Duo Unix cannot detect the IP address of the client, setting `fallback_local_ip = yes` will cause Duo Unix to send the IP address of the server it is running on. If you are using IP whitelisting ([Authorized Networks](/docs/remembered_devices#configuring-authorized-networks)), enabling this option could cause unauthorized logins if the local IP is listed in the whitelist.
`https_timeout`	Optional	Set to the number of seconds to wait for HTTPS responses from Duo Security. If Duo Security takes longer than the configured number of seconds to respond to the preauth API call, the configured failmode is triggered. Other network operations such as DNS resolution, TCP connection establishment, and the SSL handshake have their own independent timeout and retry logic. Default is 0, which disables the HTTPS timeout.

Example configuration file with additional options:

[duo]
ikey=DIXXXXXXXXXXXXXXXXXX
skey=X1hXztPX1rb1X71x1wXkpnmXXvqXXXqqj1XoXbbXu
host=api-xxxxxxxx.duosecurity.com
pushinfo=yes
autopush=yes

For more information, see the man page for login_duo.

Network Diagram

SSH connection initiated
Primary authentication
Duo Unix connection established to Duo Security over TCP port 443
Secondary authentication via Duo Security’s service
Duo Unix receives authentication response
SSH session logged in

Documentation