1PAM_DUO(8)                BSD System Manager's Manual               PAM_DUO(8)
2

NAME

4     pam_duo — PAM module for Duo authentication
5

SYNOPSIS

7     pam_duo.so [conf=⟨FILENAME⟩]
8

DESCRIPTION

10     pam_duo provides secondary authentication (typically after successful
11     password-based authentication) through the Duo authentication service.
12

OPTIONS

14     PAM module configuration options supported:
15
16     conf      Specify an alternate configuration file to load. Default is
17               /etc/duo/pam_duo.conf
18
19     debug     Debug mode; send log messages to stderr instead of syslog.
20

CONFIGURATION

22     The INI-format configuration file must have a “duo” section with the fol‐
23     lowing options:
24
25     host      Duo API host (required).
26
27     ikey      Duo integration key (required).
28
29     skey      Duo secret key (required).
30
31     groups    If specified, Duo authentication is required only for users
32               whose primary group or supplementary group list matches one of
33               the space-separated pattern-lists (see PATTERNS below).
34
35     failmode  On service or configuration errors that prevent Duo authentica‐
36               tion, fail “safe” (allow access) or “secure” (deny access). De‐
37               fault is “safe”.
38
39     pushinfo  Send command to be approved via Duo Push authentication. De‐
40               fault is “no”.
41
42     http_proxy
43               Use the specified HTTP proxy, same format as the HTTP_PROXY en‐
44               vironment variable.
45
46     autopush  Automatically send a login request to the first factor (usually
47               push), instead of prompting the user. Default is "no".
48
49     prompts   Set the maxiumum number of prompts pam_duo will show before
50               denying access.  Default is 3.
51
52     fallback_local_ip
53               If unable to detect the authorizing user's IP address, fallback
54               on the server's IP. Default is "no".
55
56     send_gecos
57               Instead of using the unix username, send Duo the contents of
58               the GECOS field from /etc/passwd.  Default is "no".
59
60     An example configuration file:
61
62             [duo]
63             host = api-deadbeef.duosecurity.com
64             ikey = SI9F...53RI
65             skey = 4MjR...Q2NmRiM2Q1Y
66             pushinfo = yes
67             autopush = yes
68
69     Other authentication restrictions may be implemented using
70     pam_listfile(8), pam_access(8), etc.
71

PATTERNS

73     A pattern consists of zero or more non-whitespace characters, ‘*’ (a
74     wildcard that matches zero or more characters), or ‘?’ (a wildcard that
75     matches exactly one character).
76
77     A pattern-list is a comma-separated list of patterns. Patterns within
78     pattern-lists may be negated by preceding them with an exclamation mark
79     (‘!’).  For example, to specify Duo authentication for all users (except
80     those that are also admins), and for guests:
81
82           groups = users,!wheel,!*admin guests
83

FILES

85     /etc/duo/pam_duo.conf
86               Default configuration file path
87

AUTHORS

89     pam_duo was written by Duo Security <support@duosecurity.com>
90

NOTES

92     When used with OpenSSH's sshd(8), only PAM-based authentication can be
93     protected with this module; pubkey authentication bypasses PAM entirely.
94     OpenSSH's PAM integration also does not honor an interactive pam_conv(3)
95     conversation, prohibiting real-time Duo status messages (such as during
96     voice callback).
97
98BSD                            September 3, 2010                           BSD
Impressum