Track SSH_CLIENT variable to allow ControlMaster sharing about duo_unix HOT 2 CLOSED

I haven't, because for my use case I preferred not to have to install Ansible on any of our production systems.

Configuring a special user that has the ability to manage all my systems AND bypasses two factor authentication also sounds like a really bad idea - that is exactly the sort of user that I WANT to use 2FA. :)

I considered this a separate request than #9 because I don't want it to track by IP address, I want it to track by connection. As long as the master connection is open, it seems reasonable to allow skipping 2FA for other SSH sessions traveling over the same connection. A separate connection would require a separate 2FA.

That seems like a pretty decent feature to me.

from duo_unix.

Hi Ian!
Thanks for the feature request. Have you considered using Duo's Trusted Networks feature? This would allow you to bypass 2fa when running Ansible from a known IP. Alternatively, you could configure Ansible to use a special user, and have your Duo admin bypass 2fa for that user.

Further tracking for SSH_CLIENT in #9

Thanks for using Duo!

from duo_unix.