Duo Unix Login...

[Michael Schwartz]

Russ,

I checked with Gluu's system admin and we do use the Duo PAM module, which
also covers sudo. It would be great if there was a Duo Shib authentication
plugin. I will suggest this to them.

- Mike


-----Original Message-----
Sent: Tuesday, September 04, 2012 3:49 PM
To: Shib Dev
Subject: Re: RFC extensions to Shibboleth

Michael Schwartz <mike at gluu.org> writes:

> Duo Security has a clever Linux integration. They let the normal PAM 
> unix authentication proceed as normal. This is the first factor. On 
> login, they run a script on the .profile that allows you to select the 
> second factor:  i.e. HTTP Push to your mobile, SMS or phone call. You 
> could take a similar approach with Shib.

That seems insecure when done in .profile, by which point it's really too
late to be doing authorization.  What prevents the user from interrupting
the profile script with Ctrl-C to bypass the second factor?  What if the
user wants to run something non-interactively, at which point there's no tty
to use to prompt?

I wish people would not try to avoid writing a PAM module when what they
really want is a PAM module.  Writing a proper PAM module is just not that
hard.

-- 
Russ Allbery (rra at stanford.edu)             <http://www.eyrie.org/~eagle/>