Duo Authentication Proxy failmode

The Duo Authentication Proxy is an on-premises software service that receives authentication requests from your local devices and applications via RADIUS or LDAP, optionally performs primary authentication against your existing LDAP directory or RADIUS authentication server, and then contacts Duo to perform secondary authentication. Once the user approves the two-factor request (received as a push notification from Duo Mobile, or as a phone call, etc.), the Duo proxy returns access approval to the requesting device or application.


In addition to providing two-factor authentication, the Duo Authentication Proxy is a required component for importing Active Directory or OpenLDAP users into Duo via sync, Active Directory authentication for Duo Single Sign-On, and can also act as an HTTP proxy itself for other systems that also need to contact Duo's cloud service.


Configuration:


The Duo Authentication Proxy configuration file is named authproxy.cfg, and located in the conf subdirectory of the proxy installation.


Windows:

C:\Program Files\Duo Security Authentication Proxy\conf

Linux:

/opt/duoauthproxy/conf

Failmode:


The Duo Authentication Proxy can be configured to follow one of the following failmode behaviors:

  • Safe: If the Authentication Proxy cannot communicate to Duo's cloud service, you will be allowed through based on your primary credentials. This is the default behavior.

  • Secure: If the Authentication Proxy cannot communicate to Duo's cloud service, you will not be allowed to authenticate.


For example:

[radius_server_auto] 
ikey=DIXXXXXXXXXXXXXXXXXX 
skey=XXXXXXXXXXXXXXXXXXXX 
api_host=api-XXX.duosecurity.com 
failmode=secure 
radius_ip_1=5.6.7.8 
radius_secret_1=XXX
client=radius_client

Check your configuration and keep safe!


gif

41 views0 comments

Recent Posts

See All

The Cisco Integrated Management Interface (CIMC) permits monitoring of the server inventory, health, and system event logs using the built-in Cisco Integrated Management Controller (CIMC) GUI or CLI i

Cisco ISE Upgrade Readiness Tool (URT) helps detect and fix any data upgrade issues before you start the upgrade process. Most of the upgrade failures occur because of data upgrade/corruption issues.

When you try to back up the ISE configuration, the backup process fails even though there is enough disk space available. Follow some steps to fix this issue: ise/admin# show backup status %% Configur