The number of security breaks occurring in recent memory has increased drastically. Whether it is a web service provider like Evernote, Twitter or LinkedIn, or a retailer like Target, or even a software company like Microsoft, security breaches are on the rise. Many security gurus are touting claims that this can all be avoided by implementing 2FA the problems is for many small companies such a solutions have typically been out of reach. This is where a relatively young startup Duo Security can provide the system needed to make your two factor authentication a reality.
One of the great features is their ‘FREE” mobile security app.
I am also proud to say that they offer their 2FA solution on a wide array of web platforms such as WordPress as well as numerous server operating systems based on such as FreeBSD as well as many distributions of Linux. Most importantly they offer a free account version for small companies and have some extremely well written documentation to help you get started.
Their operating system security product comes in basically two flavors one for logins and a more comprehensive for everything else. Basically it boils down to if all you want to do is add an extra layer of security to your login then the login_duo is fine. However, if you want to add 2FA to sudo then you will want to implement the pam_duo product. Fortunately, as I previously mentioned their online documentation is spot on so you will have very little trouble getting your system up and running.
The only negative aspect that I ran into is with the login_duo in that I have several third party vendor type solutions that I am not able to use a two factor authentication with. For instance my current deployment & integration system although ssh key based is an automated process so there is no cel phone monitoring human to respond to the challenge. Fortunately, you can add a whitelist group to the login_duo.conf. What I mean is create a group for the specific IDs that you want to whitelist in your /etc/group and then note that in the groups option of the conf prefixed with a ! character. For instance the following line would basically exempt anyone in the ‘special_grp form the 2FA challenge.
groups = !special_grp
One of the clear shining benefits of their system is the ‘FREE’ duo sercurity mobile app. Once setup properly your 2fa challenges can be pushed to the app installed on your paired mobile phone automatically. If you prefer text messages or a phone call that is also an option and you can even configure the challenger to offer you a choice of the three options.
The most important thing to note is that from the moment I signed up for an account to the time I completed my first ssh login with a successful 2FA challenge was approximately 30 minutes. This included the time it took to download and compile the Duo Security for UNIX tarball. All in all I would say this was a awesome win.
Related articles
Leave a Reply