Duo Authentication Proxy failmode

The Duo Authentication Proxy is an on-premises software service that receives authentication requests from your local devices and applications via RADIUS or LDAP, optionally performs primary authentication against your existing LDAP directory or RADIUS authentication server, and then contacts Duo to perform secondary authentication. Once the user approves the two-factor request (received as a push notification from Duo Mobile, or as a phone call, etc.), the Duo proxy returns access approval to the requesting device or application.

In addition to providing two-factor authentication, the Duo Authentication Proxy is a required component for importing Active Directory or OpenLDAP users into Duo via sync, Active Directory authentication for Duo Single Sign-On, and can also act as an HTTP proxy itself for other systems that also need to contact Duo's cloud service.

Configuration:

The Duo Authentication Proxy configuration file is named authproxy.cfg, and located in the conf subdirectory of the proxy installation.

▪ Windows:

C:\Program Files\Duo Security Authentication Proxy\conf

▪ Linux:

/opt/duoauthproxy/conf

Failmode:

The Duo Authentication Proxy can be configured to follow one of the following failmode behaviors:

• Safe: If the Authentication Proxy cannot communicate to Duo's cloud service, you will be allowed through based on your primary credentials. This is the default behavior.

• Secure: If the Authentication Proxy cannot communicate to Duo's cloud service, you will not be allowed to authenticate.

For example:

[radius_server_auto] 
ikey=DIXXXXXXXXXXXXXXXXXX 
skey=XXXXXXXXXXXXXXXXXXXX 
api_host=api-XXX.duosecurity.com 
failmode=secure 
radius_ip_1=5.6.7.8 
radius_secret_1=XXX
client=radius_client

Check your configuration and keep safe!