1364536 - Duo 2FA setup for Contegix

Status: RESOLVED FIXED

(Infrastructure & Operations :: Multi-Factor Authentication, task)

Description

[Shyam Mani [:fox2mike]]

Didn't realize this needed another bug, my bad! 

We need to do two things here :

1) Setup Duo to allow contegix to accept 2FA via their support line 
2) Give contegix the ssh config pieces and make sure the machines have Duo enabled (for my account, as well as theirs) 

Thanks!

Comment 1

[Guillaume Destuynder [:kang] [this account is no longer active]]

I can give you an integration id/key for Duo+Contegix - what else do you need as far as configuration? (i'm sending these encrypted separately)

Our setup with Duo is in Puppet, basically, though you can also use this documentation:

https://wiki.mozilla.org/Security/Guidelines/OpenSSH#Multi-Factor_Authentication_.28OpenSSH_6.3.2B.29
together with pam_duo that you can get from https://duo.com/docs/duounix#installation

The difference is that our version of pam_duo does LDAP calls to resolve custom usernames - which I believe you will not need (https://github.com/duosecurity/duo_unix/compare/master...gdestuynder:master otherwise, for information)

Comment 2

[Guillaume Destuynder [:kang] [this account is no longer active]]

Note: I will need the contegix (ldap) user to add it to the group that will allow this to work as well, whenever it is created. The ssh username will have to match that user name as well unless using the pam_duo module above that supports LDAP.

Comment 3

[Shyam Mani [:fox2mike]]

:kang and I worked through this today, will update this once it's setup on the Contegix end and has been tested.

Comment 4

[Guillaume Destuynder [:kang] [this account is no longer active]]

Just checking if you need any more support from me or if this is ready to be closed
So far:

- contegix and [e-mail] duo accounts were created
- contegix ssh integration was created
- IKEY/SKEY/API were communicated to :fox2mike using gpg
- we tested phone authentication
- we had a quick overview of the SSH setup using Duo's packages

Comment 5

[Shyam Mani [:fox2mike]]

Seems like this is all good to go and tested from the Contegix side. Thanks for your help!