Comments (4)
breakwaterlabs
commented on August 17, 2024
1
If there is interest in this feature I would be happy to write the code and issue a pull request.
from duo_unix.
breakwaterlabs
commented on August 17, 2024
1
Aaron,
There are two issues here.
The first is that duo's documentation is flat out incorrect here as
authselect is a default part of the RHEL 8 stack, and thus modifying pam
files directly *will* result in breakage at some future point. The manner
and timing of that breakage are both hard to predict, making this pretty
much the most obnoxious sort of stealth misconfiguration.
The second issue is precisely that everyone's stack is different, and a
blanket suggestion "insert this line into your pam" is not going to
generally work. However, authselect ships 3 standard profiles and those are
good starting points for one or two custom profiles.
If Duo were to suggest and maintain two basic profiles-- local auth, and
SSSD-- and were to clearly explain what they do and that they don't cover
every use case (e.g. smartcards), you would cover 95% of use cases while
also enabling people to try the profile out without potentially breaking
their auth stack and locking themselves out.
Given Red Hat's strong commitment to auth select, this seems somewhat
mandated by the choice of supported platform anyways.
…On Fri, Jan 20, 2023 at 2:31 PM Aaron ***@***.***> wrote:
Thanks for the offers and interest, but we are unlikely to proceed with
this feature request.
On paper this seems like a great idea. However, multiple years of handling
questions from customers about their PAM stacks has taught us that Duo
trying to be helpful with PAM configuration actually just makes things
worse. It seems like every customer wants something different from their
PAM stack; while the authselect templates address that, it requires those
admins to have to understand *both* the authselect mechanisms and the
resultant PAM stack in order to configure their system appropriately. So
instead, many admins, in a rush, just copy anything Duo provides and this
leads to a worse outcome for both them and us.
That being said, if there's a way to introduce authselect profiles in a
way that makes it *easier* for admins to get the correct PAM
configuration, while having to understand PAM and authselect *less*, that
would be ideal!
—
Reply to this email directly, view it on GitHub
<#218 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/ACGLX3NVR6H2BBZHIFIMAJLWTLRXNANCNFSM5PERWGSQ>
.
You are receiving this because you authored the thread.Message ID:
***@***.***>
from duo_unix.
Sepiidae
commented on August 17, 2024
This is an older feature request, but I agree this is needed. We deploy IPA on an HPC cluster and activating ipa disables Duo upon enrollment.
AUTH profiles do a great job of decreasing the risk of really messing up your PAM configuration. I know certain admin (me) who's initial setup disabled password authentication in favor of just using duo. Oppps...
from duo_unix.
AaronAtDuo
commented on August 17, 2024
Thanks for the offers and interest, but we are unlikely to proceed with this feature request.
On paper this seems like a great idea. However, multiple years of handling questions from customers about their PAM stacks has taught us that Duo trying to be helpful with PAM configuration actually just makes things worse. It seems like every customer wants something different from their PAM stack; while the authselect templates address that, it requires those admins to have to understand both the authselect mechanisms and the resultant PAM stack in order to configure their system appropriately. So instead, many admins, in a rush, just copy anything Duo provides and this leads to a worse outcome for both them and us.
That being said, if there's a way to introduce authselect profiles in a way that makes it easier for admins to get the correct PAM configuration, while having to understand PAM and authselect less, that would be ideal!
from duo_unix.
Related Issues (20)
- Are there any tips as to how to get NetDrive or SSHFS to work with pam_duo? HOT 2
- Autopush should be configurable by device, not globally HOT 2
- login_duo: no selection output and automatically pushes to first phone in list with eternal terminal HOT 2
- duo_unix-1.12.1-4.el8 and setuid HOT 3
- Duo Unix 2.x RPM Digests on RHEL 8 with FIPS enabled HOT 7
- Feature request: behavior in situation of missing conf file and not member of groups directive HOT 4
- Bbbb
- More of a feature request, would like to have ,push# implemented like the Fortinet VPN module has HOT 2
- PAM_SUCCESS returned for non-duo users instead of PAM_IGNORE HOT 8
- /usr/sbin/login_duo returning no such file or directory after fresh install of duo HOT 1
- Manpages (login_duo/login_duo.8, pam_duo/pam_duo.8) hardcodes /etc instead of adjusting path according to --prefix
- Choice of the second factor should have a default value
- 8.8.8.8 DNS Server is hardcoded HOT 1
- duo_unix not working with openssl 3.0.8 HOT 4
- Order of DUO Devices Displayed Incorrectly for Users with 10 or More Devices HOT 3
- Duo UNIX PAM module failing on AIX
- Wrong path for duo configuration file in duo_unix-2.0.3 HOT 4
- Autopush with password pushes prompt twice HOT 5
- https_init: result from `RAND_load_file` is unchecked
- Setting https_timeout does not invoke failsafe mode as documented
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from duo_unix.