Feedback Was this page helpful? Let us know how we can make it better.

Duo can be easily added to any Unix system to protect remote (SSH) or local logins with the addition of a simple pam_duo PAM module. It has been tested on Linux (RedHat, Fedora, CentOS, Debian, Ubuntu, Amazon Linux), BSD (FreeBSD, NetBSD, OpenBSD), Solaris, and AIX. The code is open-source and available on GitHub.

Duo Network Gateway provides SSH access to internal hosts without a VPN or jump host with trusted endpoint detection and session awareness. Learn more.

Overview

Duo Unix with Pluggable Authentication Modules (PAM) support provides a secure and customizable method for protecting Unix and Linux logins. We recommend deploying the pam_duo module in most scenarios, but if you are unable to use PAM see our login_duo instructions.

Connectivity Requirements This application communicates with Duo's service on TCP port 443. Firewall configurations that restrict outbound access to Duo's service with rules using destination IP addresses or IP address ranges aren't recommended, since these may change over time to maintain our service's high availability. If your organization requires IP-based rules, please review this Duo KB article.

Walkthrough Video

First Steps

Before moving on to the deployment steps, it's a good idea to familiarize yourself with Duo administration concepts and features like options for applications, available methods for enrolling Duo users, and Duo policy settings and how to apply them. See all Duo Administrator documentation.

Then you'll need to:

Sign up for a Duo account. Log in to the Duo Admin Panel and navigate to Applications . Click Protect an Application and locate UNIX Application in the applications list. Click Protect to get your integration key , secret key , and API hostname . You'll need this information to complete your setup. See Protecting Applications for more information about protecting applications in Duo and additional application options. Download the latest version of duo_unix (view checksum). From the command line you can use curl or wget to download the file, like $ wget https://dl.duosecurity.com/duo_unix-latest.tar.gz .

Treat your secret key like a password The security of your Duo application is tied to the security of your secret key (skey). Secure it as you would any sensitive credential. Don't share it with unauthorized individuals or email it to anyone under any circumstances!

Installation

FIPS Support

Duo Unix is FIPS-compliant as of version 1.10.4 when run on any machine that has an operating system-wide FIPS mode (like Centos/RedHat 7, Ubuntu 16.04, etc.). No additional flags or options are required.

Install pam_duo Prerequisites

OpenSSL development headers and libraries are required for pam_duo , as well as libpam . When compiling on SUSE/SLES, the zlib package is also necessary.

Dependency Platform Installation OpenSSL FreeBSD, NetBSD Installed by default Debian, Ubuntu apt-get install libssl-dev Red Hat, Fedora, CentOS, Amazon Linux yum install openssl-devel SUSE/SLES zypper install libopenssl-devel Solaris pkg install openssl AIX 3rd party packages or source build libpam FreeBSD, NetBSD, Solaris, AIX Installed by default Debian, Ubuntu apt-get install libpam-dev Red Hat, Fedora, CentOS, Amazon Linux yum install pam-devel SUSE/SLES zypper install pam-devel selinux-policy-devel CentOS 7 & 8, Red Hat 7 & 8 (if using SELinux) yum install selinux-policy-devel bzip2 CentOS 7 & 8, Red Hat 7 & 8 (if using SELinux) yum install bzip2 zlib SUSE/SLES zypper install zlib-devel

You also need a compiler like gcc installed on your system to build Duo Unix.

Install pam_duo

Once the required dependencies are built and installed, build and install duo_unix.

Extract the downloaded tarball for duo_unix and change to the extracted directory (note your actual extracted directory name reflects the actual version downloaded; the example syntax below references version 1.11.4). View checksums for Duo downloads here. $ tar zxf duo_unix-latest.tar.gz $ cd duo_unix-1.11.4 Build and install duo_unix with PAM support ( pam_duo ). $ ./configure --with-pam --prefix=/usr && make && sudo make install For advanced build options, see the README file in the source tarball. Once duo_unix is installed, edit /etc/duo/pam_duo.conf (in /etc/duo or /etc/security ) to add the integration key, secret key, and API hostname from your Duo Unix application. [duo] ; Duo integration key ikey = INTEGRATION_KEY ; Duo secret key skey = SECRET_KEY ; Duo API hostname host = API_HOSTNAME You may also add optional Duo configuration options to pam_duo.conf . See the table in Duo Configuration Options for all available settings.

Public Key Authentication

If you would like to use pam_duo with SSH public key authentication, make the following changes to your sshd_config file (usually in /etc or /etc/ssh ).

This feature is only available with OpenSSH 6.2+, SSH protocol 2, and Duo Unix 1.9.15 or later.

PubkeyAuthentication yes PasswordAuthentication no AuthenticationMethods publickey,keyboard-interactive

We recommend leaving a root shell open while making any changes to your PAM configuration, in order to prevent accidentally locking yourself out. Additionally, always make sure your PAM configuration works locally before testing it with SSH logins.

PAM Configuration

You'll need to modify your system's PAM configuration to include a line like the following:

auth required pam_duo.so

Depending on your OS or architecture, the pam_duo.so module might be in /lib64/security instead of the default location /lib/security . If so, specify the full path to pam_duo.so in the PAM config file, such as /lib64/security/pam_duo.so .

The location of this line and the specified control flag (e.g. "required", "requisite", "sufficient") varies. For most common configurations, place pam_duo directly after pam_unix (frequently found in common-auth or system-auth on Linux), set pam_unix 's control flag to "requisite", and set pam_duo 's control flag to whatever pam_unix used to be.

If you want to use pam_duo with your installation of OpenSSH sshd , set both UsePAM and ChallengeResponseAuthentication to yes in your sshd_config file (usually in /etc or /etc/ssh ). You should also set UseDNS to no so that PAM Duo is always passed the IP address of the connecting user, rather than the resolved hostname.

UsePAM yes ChallengeResponseAuthentication yes UseDNS no

Be sure to restart the SSH service after making edits to sshd and sshd_config to apply the updated configuration with Duo.

PAM Examples

PAM configuration examples for common Linux systems:

Remember that you may need to specify the full path to pam_duo.so in the PAM config file, such as /lib64/security/pam_duo.so if the module is not in the default location /lib/security .

CentOS

Ubuntu

Red Hat Enterprise Linux

Debian

Amazon Linux

FreeBSD

AIX 8

7

6

5 CentOS 8 SSH Public Key Authentication /etc/pam.d/sshd Before: auth required pam_sepermit.so auth substack password-auth auth include postlogin After: auth required pam_sepermit.so auth required pam_env.so auth sufficient pam_duo.so auth required pam_deny.so auth include postlogin SELinux If SELinux is blocking pam_duo from contacting Duo's service then it will invoke the your configured failmode (either safe or secure) and not show a Duo prompt. If you are running SELinux you must install the selinux-policy-devel prerequisite package and also update your policies to include authlogin_duo (run from the location where you built Duo Unix): sudo make -C pam_duo semodule sudo make -C pam_duo semodule-install This allows sshd to make outgoing HTTP connections, which is required for Duo authentication to complete. Verify that your SELinux configuration has been updated to include Duo: $ semodule -l | grep duo The semodule output should include: authlogin_duo 2.1.0 There are two adjustable tunables: pam_duo_permit_local_login allows local logins to use pam_duo (off by default) pam_duo_permit_sshd allows sshd to use pam_duo (on by default) To turn on and off the tunables: sudo setsebool -P pam_duo_permit_sshd on/off sudo setsebool -P pam_duo_permit_local_login on/off The -P flag causes the boolean to persist through server restarts. Note: If the nis_enabled tunable is on then regardless of the value of pam_duo_permit_sshd pam_duo will always be able to access Duo via ssh. System-wide Authentication /etc/pam.d/system-auth Before: auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so After: auth required pam_env.so auth requisite pam_unix.so nullok try_first_pass auth sufficient pam_duo.so auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so CentOS 7 SSH Public Key Authentication /etc/pam.d/sshd Before: auth required pam_sepermit.so auth substack password-auth auth include postlogin After: auth required pam_sepermit.so auth required pam_env.so auth sufficient pam_duo.so auth required pam_deny.so auth include postlogin SELinux If SELinux is blocking pam_duo from contacting Duo's service then it will invoke the your configured failmode (either safe or secure) and not show a Duo prompt. If you are running SELinux you must install the selinux-policy-devel prerequisite package and also update your policies to include authlogin_duo (run from the location where you built Duo Unix): sudo make -C pam_duo semodule sudo make -C pam_duo semodule-install This allows sshd to make outgoing HTTP connections, which is required for Duo authentication to complete. Verify that your SELinux configuration has been updated to include Duo: $ semodule -l | grep duo The semodule output should include: authlogin_duo 2.1.0 There are two adjustable tunables: pam_duo_permit_local_login allows local logins to use pam_duo (off by default) pam_duo_permit_sshd allows sshd to use pam_duo (on by default) To turn on and off the tunables: sudo setsebool -P pam_duo_permit_sshd on/off sudo setsebool -P pam_duo_permit_local_login on/off The -P flag causes the boolean to persist through server restarts. Note: If the nis_enabled tunable is on then regardless of the value of pam_duo_permit_sshd pam_duo will always be able to access Duo via ssh. System-wide Authentication /etc/pam.d/system-auth Before: auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so After: auth required pam_env.so auth requisite pam_unix.so nullok try_first_pass auth sufficient pam_duo.so auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so CentOS 6 SSH Public Key Authentication /etc/pam.d/sshd Before: auth required pam_sepermit.so auth include password-auth After: auth required pam_sepermit.so auth required pam_env.so auth sufficient pam_duo.so auth required pam_deny.so SELinux If SELinux is blocking pam_duo from contacting Duo's service then it will invoke the your configured failmode (either safe or secure) and not show a Duo prompt. If you are running SELinux you must also update your policies to include authlogin_duo (run from the location where you built Duo Unix): sudo make -C pam_duo semodule sudo make -C pam_duo semodule-install This allows sshd to make outgoing HTTP connections, which is required for Duo authentication to complete. Verify that your SELinux configuration has been updated to include Duo: $ semodule -l | grep duo The semodule output should include: authlogin_duo 2.1.0 pam_duo_permit_local_login is a tunable that allows users to use pam_duo with local logins (off by default). To turn on or off tunable: sudo setsebool -P pam_duo_permit_local_login on/off The -P flag causes the boolean to persist through server restarts. The tunable pam_duo_permit_sshd has no effect. The default SELinux policy allows sshd to use tcp ports so turning this tunable off will not block pam_duo via ssh. System-wide Authentication /etc/pam.d/system-auth Before: auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so After: auth required pam_env.so auth requisite pam_unix.so nullok try_first_pass auth sufficient pam_duo.so auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so CentOS 5 IMPORTANT: Duo Unix 1.11.0 is the last release with CentOS 5 support. SSH Public Key Authentication /etc/pam.d/sshd Before: auth include system-auth After: auth required pam_env.so auth sufficient pam_duo.so auth required pam_deny.so SELinux SE Linux modules for CentOS come pre-installed in the Linux Distribution Packages. If you are running SELinux you must also update your policies to include authlogin_duo (run from the location where you built Duo Unix): sudo make -C pam_duo semodule sudo make -C pam_duo semodule-install This allows sshd to make outgoing HTTP connections, which is required for Duo authentication to complete. Verify that your SELinux configuration has been updated to include Duo: $ semodule -l | grep duo The semodule output should include: authlogin_duo 1.0 System-wide Authentication /etc/pam.d/system-auth Before: auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so After: auth required pam_env.so auth requisite pam_unix.so nullok try_first_pass auth sufficient pam_duo.so auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so 20.04

18.04

16.04

14.04

12.04 Ubuntu 20.04 SSH Public Key Authentication /etc/pam.d/sshd Before: @include common-auth After: auth [success=1 default=ignore] pam_duo.so auth requisite pam_deny.so auth required pam_permit.so System-wide Authentication /etc/pam.d/common-auth Before: auth [success=1 default=ignore] pam_unix.so nullok_secure auth requisite pam_deny.so auth required pam_permit.so After: auth requisite pam_unix.so nullok_secure auth [success=1 default=ignore] pam_duo.so auth requisite pam_deny.so auth required pam_permit.so Ubuntu 18.04 SSH Public Key Authentication /etc/pam.d/sshd Before: @include common-auth After: auth [success=1 default=ignore] pam_duo.so auth requisite pam_deny.so auth required pam_permit.so System-wide Authentication /etc/pam.d/common-auth Before: auth [success=1 default=ignore] pam_unix.so nullok_secure auth requisite pam_deny.so auth required pam_permit.so After: auth requisite pam_unix.so nullok_secure auth [success=1 default=ignore] pam_duo.so auth requisite pam_deny.so auth required pam_permit.so Ubuntu 16.04 SSH Public Key Authentication /etc/pam.d/sshd Before: @include common-auth After: auth [success=1 default=ignore] pam_duo.so auth requisite pam_deny.so auth required pam_permit.so System-wide Authentication /etc/pam.d/common-auth Before: auth [success=1 default=ignore] pam_unix.so nullok_secure auth requisite pam_deny.so auth required pam_permit.so After: auth requisite pam_unix.so nullok_secure auth [success=1 default=ignore] pam_duo.so auth requisite pam_deny.so auth required pam_permit.so Ubuntu 14.04 SSH Public Key Authentication /etc/pam.d/sshd Before: @include common-auth After: auth [success=1 default=ignore] pam_duo.so auth requisite pam_deny.so auth required pam_permit.so auth optional pam_cap.so System-wide Authentication /etc/pam.d/common-auth Before: auth [success=1 default=ignore] pam_unix.so nullok_secure auth requisite pam_deny.so After: auth requisite pam_unix.so nullok_secure auth [success=1 default=ignore] pam_duo.so auth requisite pam_deny.so Ubuntu 12.04 SSH Public Key Authentication /etc/pam.d/sshd Before: @include common-auth After: auth [success=1 default=ignore] pam_duo.so auth requisite pam_deny.so auth required pam_permit.so System-wide Authentication /etc/pam.d/common-auth Before: auth [success=1 default=ignore] pam_unix.so nullok_secure auth requisite pam_deny.so After: auth requisite pam_unix.so nullok_secure auth [success=1 default=ignore] pam_duo.so auth requisite pam_deny.so 8

7

6

5 Red Hat Enterprise Linux 8 SSH Public Key Authentication /etc/pam.d/sshd Before: auth required pam_sepermit.so auth substack password-auth auth include postlogin After: auth required pam_sepermit.so auth required pam_env.so auth sufficient pam_duo.so auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth required pam_deny.so auth include postlogin SELinux If SELinux is blocking pam_duo from contacting Duo's service then it will invoke the your configured failmode (either safe or secure) and not show a Duo prompt. If you are running SELinux you must install the selinux-policy-devel prerequisite package and also update your policies to include authlogin_duo (run from the location where you built Duo Unix): sudo make -C pam_duo semodule sudo make -C pam_duo semodule-install This allows sshd to make outgoing HTTP connections, which is required for Duo authentication to complete. Verify that your SELinux configuration has been updated to include Duo: $ semodule -l | grep duo The semodule output should include: authlogin_duo 2.1.0 There are two adjustable tunables: pam_duo_permit_local_login allows local logins to use pam_duo (off by default) pam_duo_permit_sshd allows sshd to use pam_duo (on by default) To turn on and off the tunables: sudo setsebool -P pam_duo_permit_sshd on/off sudo setsebool -P pam_duo_permit_local_login on/off The -P flag causes the boolean to persist through server restarts. Note: If the nis_enabled tunable is on then regardless of the value of pam_duo_permit_sshd pam_duo will always be able to access Duo via ssh. System-wide Authentication /etc/pam.d/system-auth Before: auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth required pam_deny.so After: auth required pam_env.so auth requisite pam_unix.so nullok try_first_pass auth sufficient pam_duo.so auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth required pam_deny.so Red Hat Enterprise Linux 7 SSH Public Key Authentication /etc/pam.d/sshd Before: auth required pam_sepermit.so auth substack password-auth auth include postlogin After: auth required pam_sepermit.so auth required pam_env.so auth sufficient pam_duo.so auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth required pam_deny.so auth include postlogin SELinux If SELinux is blocking pam_duo from contacting Duo's service then it will invoke the your configured failmode (either safe or secure) and not show a Duo prompt. If you are running SELinux you must install the selinux-policy-devel prerequisite package and also update your policies to include authlogin_duo (run from the location where you built Duo Unix): sudo make -C pam_duo semodule sudo make -C pam_duo semodule-install This allows sshd to make outgoing HTTP connections, which is required for Duo authentication to complete. Verify that your SELinux configuration has been updated to include Duo: $ semodule -l | grep duo The semodule output should include: authlogin_duo 2.1.0 There are two adjustable tunables: pam_duo_permit_local_login allows local logins to use pam_duo (off by default) pam_duo_permit_sshd allows sshd to use pam_duo (on by default) To turn on and off the tunables: sudo setsebool -P pam_duo_permit_sshd on/off sudo setsebool -P pam_duo_permit_local_login on/off The -P flag causes the boolean to persist through server restarts. Note: If the nis_enabled tunable is on then regardless of the value of pam_duo_permit_sshd pam_duo will always be able to access Duo via ssh. System-wide Authentication /etc/pam.d/system-auth Before: auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth required pam_deny.so After: auth required pam_env.so auth requisite pam_unix.so nullok try_first_pass auth sufficient pam_duo.so auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth required pam_deny.so Red Hat Enterprise Linux 6 SSH Public Key Authentication /etc/pam.d/sshd Before: auth required pam_sepermit.so auth include password-auth After: auth required pam_sepermit.so auth required pam_env.so auth sufficient pam_duo.so auth required pam_deny.so SELinux If SELinux is blocking pam_duo from contacting Duo's service then it will invoke the your configured failmode (either safe or secure) and not show a Duo prompt. If you are running SELinux you must also update your policies to include authlogin_duo (run from the location where you built Duo Unix): sudo make -C pam_duo semodule sudo make -C pam_duo semodule-install This allows sshd to make outgoing HTTP connections, which is required for Duo authentication to complete. Verify that your SELinux configuration has been updated to include Duo: $ semodule -l | grep duo The semodule output should include: authlogin_duo 2.1.0 pam_duo_permit_local_login is a tunable that allows users to use pam_duo with local logins (off by default). To turn on or off tunable: sudo setsebool -P pam_duo_permit_local_login on/off The -P flag causes the boolean to persist through server restarts. The tunable pam_duo_permit_sshd has no effect. The default SELinux policy allows sshd to use tcp ports so turning this tunable off will not block pam_duo via ssh. System-wide Authentication /etc/pam.d/system-auth Before: auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth required pam_deny.so After: auth required pam_env.so auth requisite pam_unix.so nullok try_first_pass auth sufficient pam_duo.so auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth required pam_deny.so Red Hat Enterprise Linux 5 IMPORTANT: Duo Unix 1.11.0 is the last release with RHEL 5 support. SSH Public Key Authentication /etc/pam.d/sshd Before: auth include system-auth After: auth required pam_env.so auth sufficient pam_duo.so auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so SELinux If you are running SELinux you must also update your policies to include authlogin_duo (run from the location where you built Duo Unix): sudo make -C pam_duo semodule sudo make -C pam_duo semodule-install This allows sshd to make outgoing HTTP connections, which is required for Duo authentication to complete. Verify that your SELinux configuration has been updated to include Duo: $ semodule -l | grep duo The semodule output should include: authlogin_duo 1.0 System-wide Authentication /etc/pam.d/system-auth Before: auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth required pam_deny.so After: auth required pam_env.so auth requisite pam_unix.so nullok try_first_pass auth sufficient pam_duo.so auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth required pam_deny.so 10

9

8

7

6 Debian 10 SSH Public Key Authentication /etc/pam.d/sshd Before: @include common-auth After: auth [success=1 default=ignore] pam_duo.so auth requisite pam_deny.so auth required pam_permit.so System-wide Authentication /etc/pam.d/common-auth Before: auth [success=1 default=ignore] pam_unix.so nullok_secure auth requisite pam_deny.so auth required pam_permit.so After: auth requisite pam_unix.so nullok_secure auth [success=1 default=ignore] pam_duo.so auth requisite pam_deny.so auth required pam_permit.so Debian 9 SSH Public Key Authentication /etc/pam.d/sshd Before: @include common-auth After: auth [success=1 default=ignore] pam_duo.so auth requisite pam_deny.so auth required pam_permit.so System-wide Authentication /etc/pam.d/common-auth Before: auth [success=1 default=ignore] pam_unix.so nullok_secure auth requisite pam_deny.so auth required pam_permit.so After: auth requisite pam_unix.so nullok_secure auth [success=1 default=ignore] pam_duo.so auth requisite pam_deny.so auth required pam_permit.so Debian 8 SSH Public Key Authentication /etc/pam.d/sshd Before: @include common-auth After: auth [success=1 default=ignore] pam_duo.so auth requisite pam_deny.so auth required pam_permit.so System-wide Authentication /etc/pam.d/common-auth Before: auth [success=1 default=ignore] pam_unix.so nullok_secure auth requisite pam_deny.so auth required pam_permit.so After: auth requisite pam_unix.so nullok_secure auth [success=1 default=ignore] pam_duo.so auth requisite pam_deny.so auth required pam_permit.so Debian 7 IMPORTANT: Duo Unix 1.11.1 is the last release with Debian 7 support. SSH Public Key Authentication /etc/pam.d/sshd Before: @include common-auth After: auth [success=1 default=ignore] pam_duo.so auth requisite pam_deny.so auth required pam_permit.so System-wide Authentication /etc/pam.d/common-auth Before: auth [success=1 default=ignore] pam_unix.so nullok_secure auth requisite pam_deny.so auth required pam_permit.so After: auth requisite pam_unix.so nullok_secure auth [success=1 default=ignore] pam_duo.so auth requisite pam_deny.so auth required pam_permit.so Debian 6 IMPORTANT: Duo Unix 1.9.18 is the last release with Debian 6 support. SSH Public Key Authentication /etc/pam.d/sshd Before: @include common-auth After: auth [success=1 default=ignore] pam_duo.so auth requisite pam_deny.so auth required pam_permit.so System-wide Authentication /etc/pam.d/common-auth Before: auth [success=1 default=ignore] pam_unix.so nullok_secure auth requisite pam_deny.so auth required pam_permit.so After: auth requisite pam_unix.so nullok_secure auth [success=1 default=ignore] pam_duo.so auth requisite pam_deny.so auth required pam_permit.so Amazon Linux /etc/pam.d/system-auth Before: auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so After: auth required pam_env.so auth requisite pam_unix.so nullok try_first_pass auth sufficient pam_duo.so auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so SSH Public Key Authentication /etc/pam.d/sshd Before: auth required pam_sepermit.so auth substack password-auth After: auth required pam_sepermit.so auth required pam_duo.so FreeBSD /etc/pam.d/system Before: # auth auth sufficient pam_opie.so no_warn no_fake_prompts auth requisite pam_opieaccess.so no_warn allow_local auth required pam_unix.so no_warn try_first_pass nullok After: # auth auth sufficient pam_opie.so no_warn no_fake_prompts auth requisite pam_opieaccess.so no_warn allow_local auth requisite pam_unix.so no_warn try_first_pass nullok auth requisite pam_duo.so SSH Public Key Authentication /etc/pam.d/sshd Before: # auth auth sufficient pam_opie.so no_warn no_fake_prompts auth requisite pam_opieaccess.so no_warn allow_local auth required pam_unix.so no_warn try_first_pass After: # auth auth sufficient pam_opie.so no_warn no_fake_prompts auth requisite pam_opieaccess.so no_warn allow_local auth required pam_duo.so AIX 7 Edit /etc/security/login.cfg and change this line near the bottom of the file: auth_type = STD_AUTH to read: auth_type = PAM_AUTH /etc/pam.conf Before: # Authentication # authexec auth required pam_aix dtaction auth required pam_aix dtsession auth required pam_aix dtlogin auth required pam_aix ftp auth required pam_aix imap auth required pam_aix login auth required pam_aix rexec auth required pam_aix rlogin auth sufficient pam_rhosts_auth rlogin auth required pam_aix rsh auth required pam_rhosts_auth snapp auth required pam_aix su auth required pam_aix swrole auth required pam_aix telnet auth required pam_aix xdm auth required pam_aix sshd auth required pam_aix OTHER auth required pam_prohibit After (protecting both su and ssh with Duo): # Authentication # authexec auth required pam_aix dtaction auth required pam_aix dtsession auth required pam_aix dtlogin auth required pam_aix ftp auth required pam_aix imap auth required pam_aix login auth required pam_aix rexec auth required pam_aix rlogin auth sufficient pam_rhosts_auth rlogin auth required pam_aix rsh auth required pam_rhosts_auth snapp auth required pam_aix su auth requisite pam_aix su auth required /usr/lib/security/pam_duo.so swrole auth required pam_aix telnet auth required pam_aix xdm auth required pam_aix sshd auth requisite pam_aix sshd auth required /usr/lib/security/pam_duo.so OTHER auth required pam_prohibit If sshd entries do not already exist in /etc/pam.conf then add them after all the other sections: sshd account required pam_aix sshd password required pam_aix sshd session required pam_aix

Test pam_duo

SSH into your newly configured system. If everything is set up correctly, you'll be given an enrollment link:

Copy the enrollment link and paste it into a web browser to complete Duo's enrollment process. After enrolling your authentication device with Duo you'll receive the prompt for additional verification the next time you ssh into your system.

Choose your authentication method and approve the request using your phone or other device.

Linux Distribution Packages

To more easily install and maintain Duo Unix deployments, we've built Linux packages for a variety of popular distributions. These packages are tested against the specific listed versions of their respective distributions. Please test all packages thoroughly prior to deploying them into your environment to ensure a great experience.

To download the packages, you'll need Duo's GPG key. The GPG key verifies the Duo Unix package for currently supported OS distributions and versions.

We updated the Duo GPG key for packages on supported distros on May 18, 2020. If you installed Duo before May 2020, use these commands to update the GPG key before the next time you install or upgrade Duo Unix.

The current Duo GPG key expires in May 2030.

CentOS and Red Hat Enterprise Linux (RHEL)

rpm --import https://duo.com/DUO-GPG-PUBLIC-KEY.asc

Ubuntu and Debian

curl -s https://duo.com/DUO-GPG-PUBLIC-KEY.asc | sudo apt-key add -

OS distributions identified as no longer supported in the distro-specific packages sections use a previous GPG key. We won't replace or update the GPG key on these EOL versions when it expires, and urge you to update to a supported OS.

CentOS

Ubuntu

Red Hat Enterprise Linux

Debian CentOS Tested against 8.0 64-bit, 7.1 64-bit, 6.7 32/64-bit, and 5.11 32/64-bit IMPORTANT: Duo Unix 1.11.0 is the last release with CentOS 5 support. Create /etc/yum.repos.d/duosecurity.repo with the following contents: [duosecurity] name=Duo Security Repository baseurl=https://pkg.duosecurity.com/CentOS/$releasever/$basearch enabled=1 gpgcheck=1 Execute the following shell commands for Centos 6 and later: # rpm --import https://duo.com/DUO-GPG-PUBLIC-KEY.asc # yum install duo_unix Execute the following shell commands for Centos 5: This GPG key expires in August 2020. # rpm --import https://duo.com/RPM-GPG-KEY-DUO # yum install duo_unix Ubuntu Tested against 20.04 focal 64-bit, 18.04 bionic 64-bit, 16.04 xenial 32/64-bit, 14.04.3 trusty 32/64-bit, and 12.04.5 precise 32/64-bit. Create /etc/apt/sources.list.d/duosecurity.list with the following contents: deb https://pkg.duosecurity.com/Ubuntu precise main or deb https://pkg.duosecurity.com/Ubuntu trusty main or deb https://pkg.duosecurity.com/Ubuntu xenial main or deb [arch=amd64] https://pkg.duosecurity.com/Ubuntu bionic main or deb [arch=amd64] https://pkg.duosecurity.com/Ubuntu focal main Execute the following shell commands for Ubuntu 14.04 and later: # curl -s https://duo.com/DUO-GPG-PUBLIC-KEY.asc | sudo apt-key add - # apt-get update && apt-get install duo-unix Execute the following shell commands for Ubuntu 12.04: This GPG key expires in October 2024. # curl -s https://duo.com/DUO-GPG-PUBLIC-KEY-OLD.asc | sudo apt-key add - # apt-get update && apt-get install duo-unix Red Hat Enterprise Linux Tested against 8.0 64-bit, 7.0 64-bit, 6.4 32/64-bit, and 5.10 32/64-bit. IMPORTANT: Duo Unix 1.11.0 is the last release with RHEL 5 support. Create /etc/yum.repos.d/duosecurity.repo with the following contents: [duosecurity] name=Duo Security Repository baseurl=https://pkg.duosecurity.com/RedHat/$releasever/$basearch enabled=1 gpgcheck=1 Execute the following shell commands for Red Hat 6 and later: # rpm --import https://duo.com/DUO-GPG-PUBLIC-KEY.asc # yum install duo_unix Execute the following shell commands for Red Hat 5: This GPG key expires in August 2020. # rpm --import https://duo.com/RPM-GPG-KEY-DUO # yum install duo_unix Debian Tested against 10.0 32/64-bit, 7.9 32/64-bit, 9.5 32/64-bit, 8.2 32/64-bit, and 6.0.10 32/64-bit. IMPORTANT: Duo Unix 1.11.1 is the last release with Debian 7 support and 1.9.19 is the last release with Debian 6 support. Create /etc/apt/sources.list.d/duosecurity.list with the following contents: deb https//pkg.duosecurity.com/Debian squeeze main or deb https://pkg.duosecurity.com/Debian wheezy main or deb https://pkg.duosecurity.com/Debian jessie main or deb https://pkg.duosecurity.com/Debian stretch main or deb https://pkg.duosecurity.com/Debian buster main Execute the following shell commands for Debian 8 and later: # curl -s https://duo.com/DUO-GPG-PUBLIC-KEY.asc | sudo apt-key add - # apt-get update && apt-get install duo-unix Execute the following shell commands for Debian 6 or 7: This GPG key expires in August 2020. # curl -s https://duo.com/APT-GPG-KEY-DUO | sudo apt-key add - # apt-get update && apt-get install duo-unix

Troubleshooting

Need some help? Take a look at the Duo UNIX Frequently Asked Questions (FAQ) page or try searching our Duo UNIX Knowledge Base articles or Community discussions. For further assistance, contact Support.

If you open a support case with Duo, be sure to use the Duo Unix Support Tool to create a tarball you can send to the support engineer to aid with troubleshooting.

Duo Configuration Options

The pam_duo.conf configuration files use the INI format. It can take the following options:

Key Required? Description ikey Required Your integration key skey Required Your secret key host Required Your API hostname i.e. api-XXXXXXXX.duosecurity.com groups Optional If specified, Duo authentication is required only for users whose primary group or supplementary group list matches one of the space-separated pattern lists. A pattern consists of zero or more non-whitespace characters, " * " (a wild card that matches zero or more characters), or " ? " (a wildcard that matches exactly one character). A pattern-list is a comma-separated list of patterns. Patterns within pattern-lists may be negated by preceding them with an exclamation mark (" ! "). For example, to specify Duo authentication for all users (except those that are also admins), and for guests: groups = users,!wheel,!*admin guests failmode Optional On service or configuration errors that prevent Duo authentication, fail "safe" (allow access) or "secure" (deny access). The default is "safe". pushinfo Optional Include information such as the command to be executed in the Duo Push message. Either "yes" or "no". The default is "no". http_proxy Optional Use the specified HTTP proxy. If the HTTP proxy requires authentication, include the credentials in the proxy URL. Example format: http_proxy=http://username:password@proxy.example.org:8080 autopush Optional Either "yes" or "no". Default is "no". If "yes", Duo Unix will automatically send a push login request to the user's phone, falling back on a phone call if push is unavailable. Note that this effectively disables passcode authentication. If "no", the user will be prompted to choose an authentication method. When configured with autopush = yes , we recommend setting prompts = 1 . motd Optional Print the contents of /etc/motd to screen after a successful login. Either "yes" or "no". The default is "no". This option is only available for login_duo . prompts Optional If a user fails to authenticate with a second factor, Duo Unix will prompt the user to authenticate again. This option sets the maximum number of prompts that Duo Unix will display before denying access. Must be 1, 2, or 3. Default is 3. For example, when prompts = 1 , the user will have to successfully authenticate on the first prompt, whereas if prompts = 2 , if the user enters incorrect information at the initial prompt, he/she will be prompted to authenticate again. When configured with autopush = yes , we recommend setting prompts = 1 . accept_env_factor Optional Look for factor selection or passcode in the $DUO_PASSCODE environment variable before prompting the user for input. When $DUO_PASSCODE is non-empty, it will override autopush. The SSH client will need SendEnv DUO_PASSCODE in its configuration, and the SSH server will similarily need AcceptEnv DUO_PASSCODE . Default is "no" . This option is only available for login_duo . fallback_local_ip Optional Duo Unix reports the IP address of the authorizing user, for the purposes of authorization and network allow/deny. If Duo Unix cannot detect the IP address of the client, setting fallback_local_ip = yes will cause Duo Unix to send the IP address of the server it is running on. If you are using Authorized Networks, enabling this option could cause unauthorized logins if the local IP is listed in the allow list. https_timeout Optional Set to the number of seconds to wait for HTTPS responses from Duo Security. If Duo Security takes longer than the configured number of seconds to respond to the preauth API call, the configured failmode is triggered. Other network operations such as DNS resolution, TCP connection establishment, and the SSL handshake have their own independent timeout and retry logic. Default is 0, which disables the HTTPS timeout. If you specify an https_timeout value for Duo Unix, be sure that you do not set a conflicting socket timeout. send_gecos Optional Sends the entire GECOS field as the Duo username. Default is "no" ; the GECOS field is not used or parsed. If you specify gecos_username_pos and gecos_delim , this setting is ignored. gecos_username_pos Optional Specify this option to select what position from the GECOS field will be used as the username. Positions are separated by whatever you specify in gecos_delim or the default delimeter, a comma ( , ). For example, if the /etc/passwd entry for a user is: test_user:x:UID:GID:gecos1,gecos2,gecos3:/home/test_user:/bin/bash Then setting gecos_username_pos=2 sends gecos2 as the Duo username. If not configured, the GECOS field is not parsed for the username. Overrides send_gecos , if set. gecos_delim Optional Specify this option to change the default value of the GECOS delimiter from a comma to another character. The new delimeter specified must be exactly one character, and must a valid punctuation character other than a colon ( : ). For example, if the /etc/passwd entry for a user is: test_user:x:UID:GID:gecos1/gecos2/gecos3:/home/test_user:/bin/bash Then setting gecos_username_pos=3 and gecos_delim=/ sends gecos3 as the Duo username. If not configured, the default comma ( , ) GECOS field delimiter is used.

Example configuration file with additional options:

[duo] ikey=DIXXXXXXXXXXXXXXXXXX skey=X1hXztPX1rb1X71x1wXkpnmXXvqXXXqqj1XoXbbXu host=api-xxxxxxxx.duosecurity.com pushinfo=yes autopush=yes

For more information, see the man page for login_duo .

Network Diagram