PAM_DUO(8)

💖 NAME 💖

pam_duo — bestie, it's a PAM module for Duo authentication ✨

---

🦋 SYNOPSIS 🦋

pam_duo.so [conf=⟨FILENAME⟩]

---

🌸 DESCRIPTION 🌸

okay so pam_duo gives you secondary authentication — usually the step that happens after your password-based auth already went through — and it does that via the Duo authentication service. it's giving "you got past the door, now show me the second key" 🔐💅

---

✨ OPTIONS ✨

here's every config option the PAM module itself supports, no gatekeeping:

• conf — point it at an alternate configuration file to load instead. default is /etc/duo/pam_duo.conf.
• debug — debug mode, babes. log messages go to stderr instead of syslog.

---

🎀 CONFIGURATION 🎀

the config file is INI-format and it must have a "duo" section, with these options inside 👇

• host — the Duo API host. required.
• ikey — the Duo integration key. required.
• skey — the Duo secret key. required.
• groups — if you set this, Duo authentication is only required for users whose primary group or supplementary group list matches one of the space-separated pattern-lists (go look at PATTERNS below, iykyk).
• failmode — when service or configuration errors happen and Duo authentication can't go through, do you fail "safe" (allow access) or "secure" (deny access)? default is "safe".
• pushinfo — send the command to be approved via Duo Push authentication. default is "no".
• http_proxy — use the specified HTTP proxy. same format as the HTTP_PROXY environment variable.
• autopush — automatically send a login request to the first factor (usually push), instead of prompting the user. default is "no".
• verified_push — enable support for Duo Verified Push authentication. cannot be used together with autopush. default is "no".
• prompts — set the maximum number of prompts pam_duo will show before denying access. default is 3.
• fallback_local_ip — if it can't detect the authorizing user's IP address, fall back on the server's IP. default is "no".
• send_gecos — instead of using the unix username, send Duo the contents of the GECOS field from /etc/passwd. default is "no".

and here's a whole example config file so you can see the vibe 🫶

[duo]
host = api-deadbeef.duosecurity.com
ikey = SI9F...53RI
skey = 4MjR...Q2NmRiM2Q1Y
pushinfo = yes
autopush = yes

other authentication restrictions may be implemented using pam_listfile(8), pam_access(8), etc. so many options, we love to see it 💜

---

🌈 PATTERNS 🌈

a pattern is made of:

• zero or more non-whitespace characters,
• '*' — a wildcard that matches zero or more characters,
• or '?' — a wildcard that matches exactly one character.

a pattern-list is a comma-separated list of patterns. and bestie, patterns inside pattern-lists can be negated by putting an exclamation mark ('!') in front of them.

so for example, to specify Duo authentication for all users (except those that are also admins), and for guests:

groups = users,!wheel,!*admin guests

periodt. 💅

---

🍓 FILES 🍓

• /etc/duo/pam_duo.conf — default configuration file path

---

👑 AUTHORS 👑

pam_duo was written by Duo Security <support@duosecurity.com> 🫶

---

💀 NOTES 💀

when it's used with OpenSSH's sshd(8), only PAM-based authentication can be protected with this module — pubkey authentication bypasses PAM entirely. no cap. 😭

also: OpenSSH's PAM integration does not honor an interactive pam_conv(3) conversation, which prohibits real-time Duo status messages (such as during voice callback). so don't come for this module about that, it literally can't 🙈

---

okay that's the whole thing, you ate it, iconic, main character energy fr fr ⭐💖

this page is from Debian, dated September 3, 2010 — yeah bestie it's been around a minute, and it's still serving. bye ily 🌸🦋🧚