AD Users are bypassed due to groups when groups config option is set, regardless of group. about duo_unix HOT 4 CLOSED

Hi @elitegoodguy,

What version of Duo Unix did you try this with? The most recent release?

Also, to make sure I understand your expectations, are you specifying a groupname or a !groupname?

groups=foo means only apply Duo 2FA to members of foo; users whose group membership does not include foo will bypass 2FA.

from duo_unix.

Sorry left that out... It's login_duo 1.12.0

That is correct I attempted groups=users,!wheel

For all users except for those in the wheel group. Maybe put the AD group that I am in? groups="Domain Users",!wheel ? I have not tried that yet.

from duo_unix.

I resolved it It was that it was allowing them through regardless of the group. You can either be included or excluded... If you are not in any group that's included you're automatically considered excluded and do not need to have 2fa. I found that once I added in a valid group name that I am 100% included then it works.

This works just fine for me because it says everyone on the domain needs duo 2fa to get into this server except for root. My login rules will lock it down further to restrict it to a certain group and allow root to login local only.

groups=domain\ users,!root

from duo_unix.

@elitegoodguy Looks like you go this working to your satisfaction, so I'll close this out. Let us know if you run into any other issues, and thanks for using Duo!

from duo_unix.