Comments (2)
I haven't, because for my use case I preferred not to have to install Ansible on any of our production systems.
Configuring a special user that has the ability to manage all my systems AND bypasses two factor authentication also sounds like a really bad idea - that is exactly the sort of user that I WANT to use 2FA. :)
I considered this a separate request than #9 because I don't want it to track by IP address, I want it to track by connection. As long as the master connection is open, it seems reasonable to allow skipping 2FA for other SSH sessions traveling over the same connection. A separate connection would require a separate 2FA.
That seems like a pretty decent feature to me.
from duo_unix.
Hi Ian!
Thanks for the feature request. Have you considered using Duo's Trusted Networks feature? This would allow you to bypass 2fa when running Ansible from a known IP. Alternatively, you could configure Ansible to use a special user, and have your Duo admin bypass 2fa for that user.
Further tracking for SSH_CLIENT in #9
Thanks for using Duo!
from duo_unix.
Related Issues (20)
- Non-interactive sessions broken when groups config option is used and motd printed HOT 1
- missing tag 1.11.5 HOT 2
- New HOT 1
- App is blank with two step authentication turned on. HOT 2
- Feature request: default PAM / authselect profiles HOT 4
- Critical Vulnerability: Default Configuration Can Leave Unenrolled Accounts (Including 'root') Exposed HOT 3
- AD Users are bypassed due to groups when groups config option is set, regardless of group. HOT 4
- RHEL 9 / Centos 9 are missing in repo HOT 2
- Are there any tips as to how to get NetDrive or SSHFS to work with pam_duo? HOT 2
- Autopush should be configurable by device, not globally HOT 2
- login_duo: no selection output and automatically pushes to first phone in list with eternal terminal HOT 2
- duo_unix-1.12.1-4.el8 and setuid HOT 3
- Duo Unix 2.x RPM Digests on RHEL 8 with FIPS enabled HOT 7
- Feature request: behavior in situation of missing conf file and not member of groups directive HOT 4
- Bbbb
- More of a feature request, would like to have ,push# implemented like the Fortinet VPN module has HOT 2
- PAM_SUCCESS returned for non-duo users instead of PAM_IGNORE HOT 8
- /usr/sbin/login_duo returning no such file or directory after fresh install of duo HOT 1
- Manpages (login_duo/login_duo.8, pam_duo/pam_duo.8) hardcodes /etc instead of adjusting path according to --prefix
- Choice of the second factor should have a default value
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from duo_unix.